X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/122f6df3259e8ca1dd96554d08cebce4b5c55acc..728dfd9595d3d6a923a227200463373eeac25928:/debian/changelog diff --git a/debian/changelog b/debian/changelog index 420cef5ad..9920c215a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,5 @@ ikiwiki (2.40) UNRELEASED; urgency=low - [ Josh Triplett ] * Add new preprocessor directive syntax¸ using a '!' prefix. Add a prefix_directives option to the setup file to turn this syntax on; currently defaults to false, for backward compatibility. Support @@ -8,7 +7,44 @@ ikiwiki (2.40) UNRELEASED; urgency=low the underlay to support either setting of prefix_directives. Add NEWS entry with migration information. - -- Josh Triplett Sat, 09 Feb 2008 23:01:19 -0800 + -- Josh Triplett Sun, 10 Feb 2008 13:18:58 -0800 + +ikiwiki (2.31.3) unstable; urgency=high + + [ Josh Triplett ] + * Do not allow the about: URI scheme; some browsers interpret about: + URIs like a limited version of data: URIs. In particular, some + versions of Internet Explorer interpret arbitrary HTML content in + about: URIs. + * Also filter the attributes cite, longdesc, and usemap, which can contain + URIs. + + [ Joey Hess ] + * meta: Check that the urls provided for authorurl, permalink, and openid + are safe and can't contain javascript. + + [ Josh Triplett ] + * Match literal '.' in URI schemas containing '.', rather than matching any + character. + * Do not allow the steam: URI scheme. + * Allow the snews: URI scheme. + * Allow the smb: URI scheme. + + -- Josh Triplett Sun, 10 Feb 2008 14:48:48 -0800 + +ikiwiki (2.31.2) unstable; urgency=high + + * The security fix in the last release had buggy handling of data:image, + now fixed. + + -- Joey Hess Sun, 10 Feb 2008 15:31:17 -0500 + +ikiwiki (2.31.1) unstable; urgency=low + + * htmlscrubber security fix: Block javascript in uris. + * Add htmlscrubber test suite. + + -- Joey Hess Sun, 10 Feb 2008 13:22:59 -0500 ikiwiki (2.31) unstable; urgency=low