Fix CSRF attacks against the preferences and edit forms. Closes: #475445

[ikiwiki.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index eed7940feb3a729c0e05ae47fc2699fc1129489b..9085d97cb6c0167186faaf220b9949ea5b857f73 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,10 @@ ikiwiki (2.42) UNRELEASED; urgency=low
 
   * aggregate: Correct a mistake in the code that dummy up a guid for feeds
     lacking one.
+  * inline: Correct handling of urls relative to baseurl in feeds.
+  * Fix CSRF attacks against the preferences and edit forms. The fix involved
+    embedding the session id in the forms, and not allowing the forms to be
+    submitted if the embedded id does not match the session id. Closes: #475445
 
  -- Joey Hess <joeyh@debian.org>  Thu, 03 Apr 2008 02:35:39 -0400