blob: 7e0d3e0bc768da3ddc138eff419b70d782e3bf8e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
ikiwiki 3.20150329 released with [[!toggle text="these changes"]]. This is a
security update fixing a cross-site scripting vulnerability.
[[!toggleable text="""
[ [[Joey Hess|joey]] ]
* Fix NULL ptr deref on ENOMEM in wrapper. (Thanks, igli)
[ [[Simon McVittie|smcv]] ]
* Really don't double-decode CGI submissions, even on Perl versions that
bundle an old enough Encode.pm for that not to be a problem: the
system might have a newer Encode.pm installed separately, like Fedora 20.
(Closes: [[!debbug 776181]]; thanks, Anders Kaseorg)
* If neither timezone nor TZ is set, set both to :/etc/localtime if
we're on a GNU system and that file exists, or GMT otherwise
* t/inline.t: accept translations of "Add a new post titled:"
(Closes: [[!debbug 779365]])
* Consistently document command-line options as e.g. --refresh, not -refresh
[ [[Amitai Schlair|schmonz]] ]
* In VCS-committed anonymous comments, link to url.
[ [[Joey Hess|joey]] ]
* Fix XSS in openid selector. Thanks, Raghav Bisht.
(Closes: [[!debbug 781483]])
"""]]
In addition, version 3.20141016.2 was released on the same day to backport
the cross-site-scripting fix to Debian 8.
[[!meta date="2015-03-29 22:46:39 +0100"]]
|