~ubuntu-branches/ubuntu/gutsy/awstats/gutsy-updates : changes

~ubuntu-branches/ubuntu/gutsy/awstats/gutsy-updates » Changes from revision 13

From Revision 13

Rev	Summary	Authors	Tags	Date
13	* SECURITY UPDATE: XSS via quotes in the "config" parameter ... * SECURITY UPDATE: XSS via quotes in the "config" parameter (CVE-2008-3714). - 1006_quote_xss.patch: upstream fixes, thanks to Florian Weimer.	Kees Cook	6.6+dfsg-1ubuntu0.1	15 years ago
12	New upstream release (Closes: #350987, #335865) New upstream release (Closes: #350987, #335865)	Charles Fry	6.6+dfsg-1	17 years ago
11	Add 'debian/patches/1005_logresolve-dates.patch': correct lo... Add 'debian/patches/1005_logresolve-dates.patch': correct log parsing, fixed in upstream 6.6 (Closes LP#51902).	Kees Cook	6.5+dfsg-1ubuntu3	17 years ago
10	debian/rules: fix CRLF encodings in examples tools (Closes L... debian/rules: fix CRLF encodings in examples tools (Closes LP#52085), fixed in upstream awstats 6.6 already.	Kees Cook	6.5+dfsg-1ubuntu2	17 years ago
9	* Merge from debian unstable. Remaining changes: * Merge from debian unstable. Remaining changes: - fix for CVE-2006-3682	Michael Vogt	6.5+dfsg-1ubuntu1	17 years ago
8	* SECURITY UPDATE: Fix path exposure on error. * SECURITY UPDATE: Fix path exposure on error. * Add 'debian/patches/1004_backport_6.6_xss-fixes.patch' to correct URL decoding and adjust error message reports. Backported from upstream. * References CVE-2006-3682 http://awstats.cvs.sourceforge.net/awstats/awstats/wwwroot/cgi-bin/awstats.pl?r1=1.867&r2=1.871	Kees Cook	6.5-2ubuntu1	17 years ago
7	[ Charles Fry ] [ Charles Fry ] * Require AWSTATS_ENABLE_CONFIG_DIR environmental variable in order to enable configdir. Closes: #365910 (thanks to Hendrik Weimer <hendrik@enyo.de>) * Integrated security patches from upstream: + Decode QueryString. Closes: #364443 (thanks to Micah Anderson <micah@debian.org>) + Sanitize migrate parameter. Closes: #365909 (thanks to Hendrik Weimer <hendrik@enyo.de>) * Indent Homepage in long description, per debian reference guideline [ Jonas Smedegaard ] * Update local cdbs snippet copyright-check.mk: + Broaden scan to also look for "(c)" by default. + Make egrep options configurable. * Semi-auto-update debian/control: + Bump up versioned build-dependency on debhelper. * Semi-auto-update debian/copyright_hints (nothing remarkable). * Set urgency=high as this upload fixes security-related bugs (bug#365909: CVE-2006-2237). * Fix including a couple of example shell scripts ignored by mistake.	Jonas Smedegaard	6.5-2	18 years ago
6	* SECURITY UPDATE: Cross-site scripting. * SECURITY UPDATE: Cross-site scripting. * debian/patches/1001_sanitize_more.patch: - Use the Sanitize function to filter out arbitrary HTML from 'diricons' parameter (analoguous to CVE-2006-1945, which is already fixed in this version). - Sanitize MigrateStats parameter (XSS if statistics updates are enabled). [CVE-2006-2237] - Patch from upstream CVS, taken from Debian's 6.5-2 version.	Martin Pitt	6.5-1ubuntu1	18 years ago
5	[ Jonas Smedegaard ] [ Jonas Smedegaard ] * New upstream release. + Recognizes GNUTLS from lynx User-Agent header. Closes: #306130 (thanks to Dmitry Baryshkov <mitya@school.ioffe.ru>). + Geoip shows countries for resolved hostnames. Closes: #317310 (thanks to Administrator <azhrarn@underhanded.org>). * Simplify watch file to better work with parser used at qa.d.o. * Improve cdbs rules: + Use quilt (rather than cdbs-internal patch system). + Add and enable new local snippets copyright-check and auto-update. + Update local snippet buildinfo (fixing its namespace). * Auto-update debian/control: + Tightened build-dependency on cdbs. + Added build-dependencies on patchutils and quilt. * Package is now team-maintained: + New maintainer: Debian AWStats Team <pkg-awstats-devel@lists.alioth.debian.org>. + Add myself as uploader. [ Charles Fry ] * Use qa.debian.org SF redirector in watch file. * Use Homepage instead of Website in debian/control, per DDR 6.2.4. * Removed patches integrated upstream	Jonas Smedegaard	6.5-1	18 years ago
4	[ Charles Fry ] [ Charles Fry ] * New co-maintainer. * Suggest libgeo-ipfree-perl. Closes: #316126 (thanks to Gunnar Wolf <gwolf@gwolf.org>). * Fixed README.Debian path to configure.pl. Closes: #313093 (thanks to Michael De Nil <michael@flex-it.be>). [ Jonas Smedegaard ] * Acknowledge NMU. Closes: bug#322591. * Bump up watch version, and adjust the default command (we have moved to SubVerSion). * Add proto to URL in long description. * User newer chown syntax in postinst (thanks to lintian).	Jonas Smedegaard	6.4-2	18 years ago
3	* New upstream release. Closes: bug#293702, #293668 (thanks ... * New upstream release. Closes: bug#293702, #293668 (thanks to Nelson A. de Oliveira <naoliv@biolinux.df.ibilce.unesp.br>). + Includes upstream fix for security bug fixed in 6.2-1.1. + Includes upstream fix for most of security bug fixed in 6.2-1.1. * Acknowledge NMUs. Closes: bug#291064, #294488 (thanks to Martin Schulze <joey@infodrom.org>, Martin Pitt <mpitt@debian.org>, Ubuntu, Joey Hess <joeyh@debian.org>, Frank Lichtenheld <djpig@debian.org> and Steve Langasek <vorlon@debian.org>). * Include patch for last parts of security bug fixed in 6.2-1.1: 01_sanitize_more.patch. * Patch (02) to include snapshot of recent development: + Fix security hole that allowed a user to read log file content even when plugin rawlog was not enabled. + Fix a possible use of AWStats for a DoS attack. + configdir option was broken on windows servers. + DebugMessages is by default set to 0 for security reasons. + Minor fixes. * References: CAN-2005-0435 - read server logs via loadplugin and pluginmode CAN-2005-0436 - code injection via PluginMode CAN-2005-0437 - directory traversal via loadplugin CAN-2005-0438 - information leak via debug	Jonas Smedegaard	6.3-1	19 years ago
2	Really fix bug#247265. Really closes: Bug#247265 (thanks to ... Really fix bug#247265. Really closes: Bug#247265 (thanks to Edward J. Shornock <ed@crazeecanuck.homelinux.net>).	Jonas Smedegaard	6.0-4	20 years ago
1	Import upstream version 6.0 Import upstream version 6.0	Jonas Smedegaard	upstream-6.0	20 years ago