Fix CSRF attacks against the preferences and edit forms. Closes: #475445

[ikiwiki.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index 4218809314891ae992ceb36918271fd1c66f2df4..9085d97cb6c0167186faaf220b9949ea5b857f73 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,15 @@
-ikiwiki (2.41) UNRELEASED; urgency=low
+ikiwiki (2.42) UNRELEASED; urgency=low
+
+  * aggregate: Correct a mistake in the code that dummy up a guid for feeds
+    lacking one.
+  * inline: Correct handling of urls relative to baseurl in feeds.
+  * Fix CSRF attacks against the preferences and edit forms. The fix involved
+    embedding the session id in the forms, and not allowing the forms to be
+    submitted if the embedded id does not match the session id. Closes: #475445
+
+ -- Joey Hess <joeyh@debian.org>  Thu, 03 Apr 2008 02:35:39 -0400
+
+ikiwiki (2.41) unstable; urgency=low
 
   [ Adeodato Simó ]
   * Preprocessor directives generated by the shortcut plugin accept a `desc`
@@ -15,6 +26,7 @@ ikiwiki (2.41) UNRELEASED; urgency=low
     patch does. Closes: #470517
   * meta: Also generate openid2 headers.
   * Handle SimpleXMLRPCDispatcher arg count change in python 2.5
+  * Provide XML-RPC proxy abstraction for Python plugins.
 
   [ Joey Hess ]
   * Add recentchangesdiff plugin that adds diffs to the recentchanges feeds.
@@ -38,8 +50,35 @@ ikiwiki (2.41) UNRELEASED; urgency=low
   * Use absolute url for feedurl when filling out the feed templates.
     Closes: #470530
   * Fix expiry of old recentchanges changeset pages.
-
- -- martin f. krafft <madduck@debian.org>  Sun, 02 Mar 2008 17:46:38 +0100
+  * French translation update. Closes: #471010
+  * external: Fix support of XML::RPC::fault.
+  * htmltidy: Pass --markup yes, in case tidy's config file disabled it.
+  * external: Add getargv and setargv methods to allow access to ikiwiki's
+    @ARGV.
+  * Correct bug in encoding of %pagestate keys, fixes edittemplate.
+  * Detect invalid pagespecs and do not merge them in add_depends,
+    as that can result in a broken merged pagespec that matches nothing.
+  * Record new pages in %pagesources temporarily when previewing so that
+    things that need to know the page source or type can query it from there.
+    Fixes previewing of tables when creating a new page.
+  * German translation update. Closes: #471540
+  * Time::Duration is no longer used, remove from docs and recommends.
+  * Store userinfo in network byte order for easy portability.
+    (Old files will be automatically converted.)
+  * Close meta tag for redir properly.
+  * smiley: Detect smileys inside pre and code tags, and do not expand.
+  * inline: Crazy optimisation to work around slow markdown.
+  * Precompile pagespecs, about 10% overall speedup.
+  * Changed to a binary index file, written using Storable, for speed.
+  * external: Work around XML RPC's lack of support for null by passing
+    a special sentinal value.
+  * inline: Allow the "feedshow" parameter to take values greater than the
+    value for "show".
+  * Added a hardlink option in the setup file, useful if the source and
+    dest are on the same filesystem and the wiki includes large media files,
+    which would normally be copied, wasting time and space.
+
+ -- Joey Hess <joeyh@debian.org>  Sat, 29 Mar 2008 21:07:22 -0400
 
 ikiwiki (2.40) unstable; urgency=low