news

2 files changed, 36 insertions, 27 deletions

diff --git a/doc/news/version_3.20140227.mdwn b/doc/news/version_3.20140227.mdwn
deleted file mode 100644
index e5f015459..000000000
--- a/doc/news/version_3.20140227.mdwn
+++ /dev/null
@@ -1,27 +0,0 @@
-ikiwiki 3.20140227 released with [[!toggle text="these changes"]]
-[[!toggleable text="""
-   * Added useragent config setting. Closes: #[737121](http://bugs.debian.org/737121)
-     Thanks, Tuomas Jormola
-   * po: Add html\_lang\_code and html\_lang\_dir template variables
-     for the language code and direction of text.
-     Thanks, Mesar Hameed
-   * Allow up to 8 levels of nested directives, rather than previous 3
-     in directive infinite loop guard.
-   * git diffurl: Do not escape / in paths to changed files, in order to
-     interoperate with cgit (gitweb works either way)
-     Thanks, intrigeri.
-   * git: Explicity push master branch, as will be needed by git 2.0's
-     change to push.default=matching by default.
-     Thanks, smcv
-   * Deal with nasty issue with gettext clobbering $@ while printing
-     error message containing it.
-     Thanks, smcv
-   * Cleanup of the openid login widget, including replacing of hotlinked
-     images from openid providers with embedded, freely licensed artwork.
-     Thanks, smcv
-   * Improve templates testing.
-     Thanks, smcv
-   * python proxy: Avoid utf-8 related crash.
-     Thanks, Antoine Beaupré
-   * Special thanks to Simon McVittie for being the patchmeister for this
-     release."""]]
\ No newline at end of file
diff --git a/doc/news/version_3.20141016.mdwn b/doc/news/version_3.20141016.mdwn
new file mode 100644
index 000000000..3a93102bd
--- /dev/null
+++ b/doc/news/version_3.20141016.mdwn
@@ -0,0 +1,36 @@
+ikiwiki 3.20141016 released with [[!toggle text="these changes"]]
+[[!toggleable text="""
+  [ Joey Hess ]
+  * Fix crash that can occur when only_committed_changes is set and a
+    file is deleted from the underlay.
+
+  [ Simon McVittie ]
+  * core: avoid dangerous use of CGI->param in list context, which led
+    to a security flaw in Bugzilla; as far as we can tell, ikiwiki
+    is not vulnerable to a similar attack, but it's best to be safe
+  * core: new reverse_proxy option prevents ikiwiki from trying to detect
+    how to make self-referential URLs by using the CGI environment variables,
+    for instance when it's deployed behind a HTTP reverse proxy
+    (Closes: [[!debbug 745759]])
+  * core: the default User-Agent is now "ikiwiki/$version" to work around
+    ModSecurity rules assuming that only malware uses libwww-perl
+  * core: use protocol-relative URLs (e.g. //www.example.com/wiki) so that
+    https stays on https and http stays on http, particularly if the
+    html5 option is enabled
+  * core: avoid mixed content when a https cgiurl links to http static pages
+    on the same server (the static pages are assumed to be accessible via
+    https too)
+  * core: force the correct top URL in w3mmode
+  * google plugin: Use search form
+  * docwiki: replace Paypal and Flattr buttons with text links
+  * comments: don't record the IP address in the wiki if the user is
+    logged in via passwordauth or httpauth
+  * templates: add ARIA roles to some page elements, if html5 is enabled.
+    Thanks, Patrick
+  * debian: build-depend on libmagickcore-6.q16-2-extra | libmagickcore-extra
+    so we can thumbnail SVGs in the docwiki
+  * debian: explicitly depend and build-depend on libcgi-pm-perl
+  * debian: drop unused python-support dependency
+  * debian: rename debian/link to debian/links so the intended symlinks appear
+  * debian: fix some wrong paths in the copyright file
+"""]]