comments: Fix XSS security hole due to missing validation of page name.

[ikiwiki.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index 4ed9bb8b2bb17728f675914b7292ca6f91b6e97d..0165a240bb0dc85d69387c197e682945573f7bc9 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,19 +1,30 @@
-ikiwiki (3.20101232) UNRELEASED; urgency=low
+ikiwiki (3.20110106) UNRELEASED; urgency=low
+
+  * inline: Pass feed titles to templates and add title and rel attributes
+    to feed links. (Giuseppe Bilotta)
+  * inline: Use class rather than id for feedlinks and blogform.
+    (Giuseppe Bilotta)
+  * comments: Fix XSS security hole due to missing validation of page name.
+
+ -- Joey Hess <joeyh@debian.org>  Thu, 06 Jan 2011 14:41:34 -0400
+
+ikiwiki (3.20110105) unstable; urgency=low
 
   * tag: Do not include tagbase in rss/atom category tags. (Giuseppe Bilotta)
   * tag: Improve display of tags with a slash in their names.
     (Giuseppe Bilotta)
-  * Fix base url when previewing. Was broken by base changes in last release.
   * Fix redirect to use a full url. Was broken (in theory) by baseurl
     changes in last release.
-  * Temporarily revert one part of the multiple url support in the last
-    release. Non-edit pages are now back to having `<base>` set to
-    the site's main url.
+  * Fix `<base>` output by cgi to have a full url again, broken by last
+    release.
   * Fix permalinks to recentchanges items and comments, broken by last
     release.
-  * Export three cgi env vars needed for CGI->url to work.
+  * Export three cgi env vars needed for CGI->url to work. Fixed
+    openid breakage from last release.
+  * Removed `IkiWiki::misctemplate()` function. Any plugins using
+    it should use `IkiWiki::cgitemplate()` instead.
 
- -- Joey Hess <joeyh@debian.org>  Tue, 04 Jan 2011 16:00:55 -0400
+ -- Joey Hess <joeyh@debian.org>  Wed, 05 Jan 2011 17:33:05 -0400
 
 ikiwiki (3.20101231) unstable; urgency=low