~ubuntu-branches/debian/squeeze/mediawiki/squeeze : changes

~ubuntu-branches/debian/squeeze/mediawiki/squeeze » Changes from revision 30

From Revision 24 to 5

Rev	Summary	Authors	Tags	Date
24	[ Thorsten Glaser ] [ Thorsten Glaser ] * debian/control: add Vcs-SVN and Vcs-Browser [ Jonathan Wiltshire ] * debian/source/format: Switch to source format 3.0 (quilt) * debian/rules: Drop CDBS quilt logic * debian_specific_config.patch: Don't just redefine MW_INSTALL_PATH, remove the original definition (LP: #406358) * debian/README.source: document use of quilt and format 3.0 (quilt) * New patch backup_documentation.patch improves documentation of maintenance/dumpBackup.php (closes: #572355) * Standards version 3.9.0 (no changes)	Jonathan Wiltshire	1:1.15.4-2	13 years ago
23	[ Jonathan Wiltshire ] [ Jonathan Wiltshire ] * New upstream security release (closes: #585918). * CVE-2010-1647: Fix a cross-site scripting (XSS) vulnerability which allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. * CVE-2010-1648: Fix a cross-site request forgery (CSRF) vulnerability in the login interface which allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form. [ Romain Beauxis ] * Put debian's package version in declared version. Should help sysadmins to keep track of installed versions, in particular with regard to security updates. * Added Jonathan Wiltshire to uploaders. * Do not clan math dir if it does not exist (for instance when running clean from SVN).	Romain Beauxis	1:1.15.4-1	13 years ago
22	* New upstream release. * New upstream release. * Fixes security issue: "MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website. If the wiki is configured to allow user scripts, say with "$wgAllowUserJs = true" in LocalSettings.php, then the attacker can proceed to mount a phishing-style attack against the victim to obtain their password."	Romain Beauxis	1:1.15.3-1	14 years ago
21	* New upstream release. * New upstream release. * Fixes security issue: "Two security issues were discovered: A CSS validation issue was discovered which allows editors to display external images in wiki pages. This is a privacy concern on public wikis, since a malicious user may link to an image on a server they control, which would allow that attacker to gather IP addresses and other information from users of the public wiki. All sites running publicly-editable MediaWiki installations are advised to upgrade. All versions of MediaWiki (prior to this one) are affected. A data leakage vulnerability was discovered in thumb.php which affects wikis which restrict access to private files using img_auth.php, or some similar scheme. All versions of MediaWiki since 1.5 are affected." * Updated standards. * Removed section about upgrading from mediawiki1.x packages in README.Debian since they do not exist in any supported distribution anymore. * Switched php5-gd and imagemagick in Suggests. Closes: #542008 * Backported patch from revision 51083 to fix a bug with invalid titles. Closes: #537134 * Backported patch from revision 61090 to add a unique guid per RSS feed element. Closes: #383130 * Refreshed patches.	Romain Beauxis	1:1.15.2-1	14 years ago
20	* New upstream release. * New upstream release. * Ack previous NMU, thanks to Nico Golde for taking care of this.	Romain Beauxis		14 years ago
19	* Non-maintainer upload by the Security Team. * Non-maintainer upload by the Security Team. * Fix cross-site scripting in [[Special:Block]] (No CVE id yet; XSS-no-CVE.patch; Closes: #537634).	Nico Golde	1:1.15.0-1.1	14 years ago
18	* New upstream release. * New upstream release. * Upstream added support for OASIS documents. Closes: #530328 * Refreshed quilt patches * Bumped standards versions to 3.8.2 * Bumped compat to 7 * Pointed to GPL-2 in debian/copyright * Added php5-sqlite to possible DB backend dependencies. Closes: #501569 * Proofread README.Debian, upgrade is documented there. Closes: #520121	Romain Beauxis		14 years ago
17	* New upstream release. * New upstream release. * Fixed issues in the installer: "A number of cross-site scripting (XSS) security vulnerabilities were discovered in the web-based installer (config/index.php). These vulnerabilities all require a live installer once the installer has been used to install a wiki, it is deactivated. Note that cross-site scripting vulnerabilities can be used to attack any website in the same cookie domain. So if you have an uninstalled copy of MediaWiki on the same site as an active web service, MediaWiki could be used to attack the active service." Closes: #514547 * Fixed typo in README.Debian Closes: #515192 * Updated japanese debconf translation, thanks to Hideki Yamane Closes: #510896 * Added a file in debian/copyright	Romain Beauxis		15 years ago
16	* New upstream release. * New upstream release. * Fix CVE-2008-5249: XSS vulnerability in MediaWiki: "An XSS vulnerability affecting all MediaWiki installations between 1.13.0 and 1.13.2." Closes: #508868 * Fix CVE-2008-5250: several local script injection vulnerabilities in MediaWiki: "o A local script injection vulnerability affecting Internet Explorer clients for all MediaWiki installations with uploads enabled. o A local script injection vulnerability affecting clients with SVG scripting capability (such as Firefox 1.5+), for all MediaWiki installations with SVG uploads enabled." Closes: #508869 * Fix CVE-2008-5252: CSRF vulnerability affecting the Special:Import feature in MediaWiki: "A CSRF vulnerability affecting the Special:Import feature, for all MediaWiki installations since the feature was introduced in 1.3.0." Closes: #508870	Romain Beauxis		15 years ago
15	* New upstream release * New upstream release * Fix CVE-2008-4408: XSS in mediawiki: "Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component." Closes: #501115	Romain Beauxis	1:1.13.2-1	15 years ago
14	* Fixed postgresql dependency * Fixed postgresql dependency Closes: #472987 * Added instructions to install and upgrade Closes: #472990, #472831	Romain Beauxis	1:1.12.0-2	16 years ago
13	* Added patch to fix pgsql select, thanks to Marc Dequènes * Added patch to fix pgsql select, thanks to Marc Dequènes Closes: #469841 * Upated README.Debian to mention php5-gd instead of php5-gd2 and texlive-latex-base instead to tetex-bin. Closes: #469558 * still setting urgency to high since previous upload didn't make it to testing.	Romain Beauxis	1:1.11.2-2	16 years ago
12	* New upstream release * New upstream release * A potential XSS injection vector affecting Microsoft Internet Explorer users has been closed.	Romain Beauxis	1:1.11.1-1	16 years ago
11	Initial upload of 1.11.0 to unstable Initial upload of 1.11.0 to unstable	Romain Beauxis	1:1.11.0-2	16 years ago
10	* Switched to mediawiki1.10 * Switched to mediawiki1.10 * Mediawiki1.10 recommends mediawiki-math (Closes: #428021)	Romain Beauxis	1:1.10	16 years ago
9	* Switched to mediawiki1.9, closes: #392932 * Switched to mediawiki1.9, closes: #392932 * Corrected typo in control, closes: #414121 * Seperated -math extension to a single package, closes: #401714	Romain Beauxis	1:1.9	17 years ago
8	Initial Release Initial Release	Romain Beauxis	1:1.7	17 years ago
7	New upstream security release. New upstream security release.	Marc Dequènes (Duck)	1.4.15-1	18 years ago
6	Added 03_config_fix.patch to fix symlink issue Added 03_config_fix.patch to fix symlink issue (Closes: #30075)	Peter Savage	1.4.14-1ubuntu1	18 years ago
5	* New upstream security release. * New upstream security release. * Removed 03_bad_version.patch.	Marc Dequènes (Duck)	1.4.14-1	18 years ago

Older »