~ubuntu-branches/ubuntu/intrepid/moodle/intrepid-updates : changes

~ubuntu-branches/ubuntu/intrepid/moodle/intrepid-updates » Changes from revision 22

From Revision 22 to 3

Rev	Summary	Authors	Tags	Date
22	* SECURITY UPDATE: backported upstream fixes from Moodle 1.8... * SECURITY UPDATE: backported upstream fixes from Moodle 1.8.9 and earlier. - CVE-2008-4796_snoopy.dpatch: did not escape shell characters when using https (MSA-09-0003). - msa090006_CVE-2009-0501_calendar.dpatch: do not expose usernames via calendar export errors. - CVE-2007-3215_phpmailer.dpatch: escape sender email address when calling sendmail. - html2text-update.dpatch: html cleaning improved (MSA-08-0026, CVE-2008-5619). - CVE-2008-5432_wiki.dpatch: escape wiki titles in recent changes list (MSA-08-0022). - msa080010_hotpot.dpatch: block SQL injections in HotPot reports (MSA-08-0010, CVE-2008-6124). - msa080004_install.dpatch: stop XSS in unconfigured installs. - msa08003_login-as.dpatch: correctly validate permissions when attempting to switch users. - msa080015_deleted-user-profiles.dpatch: do not display deleted user profiles. - msa080021_text-cleaning.dpatch: stop XSS in certain string format situations. - msa080023_message-csrf.dpatch: require sessionkey for instant messages to stop CSRF. - mdl11759_group-creation.dpatch: stop XSS in group creation. - MDL-9288_mnet.dpatch: correct escape users names in mnet. - MDL-11857_restore.dpatch: stop SQL injection from restore. - mdl12079_essayquestions.dpatch: block XSS in essay questions. - mdl12793_PARAM_HOST.dpatch: block XSS in host parameter. - mdl14806_wiki-params.dpatch: block XSS in wiki parameters. - msa090001.dpatch: allow removal of deleted-user pictures. - msa090002.dpatch: block access to deleted-user pictures. - msa090004.dpatch: stop XSS in "login as" (CVE-2009-0502). - msa090007{,_cleanup-prep}.dpatch: add more input validation to prevent XSS via inputs (CVE-2009-0500). - msa090008.dpatch: add session key to forum actions to stop CSRF (CVE-2009-0499). - CVE-2009-1171.dpatch: blacklist TeX functions that allow arbitrary file inclusion (MSA-09-0009, CVE-2009-1171). * SECURITY UPDATE: Smarty template processor security fixes. - smarty_dollar_sign.dpatch: stop php execution via templates (CVE-2008-4810, CVE-2008-4811). - smarty_math_backticks.dpatch: stop backtick processing in math expressions (CVE-2009-1669). * SECURITY UPDATE: remove unsafe and unused SpellChecker extension. - debian/rules: remove SpellChecker (CVE-2008-5153).	Kees Cook	1.8.2-1.2ubuntu2.1	14 years ago
21	* SECURITY UPDATE: arbitrary code execution via multiple vec... * SECURITY UPDATE: arbitrary code execution via multiple vectors. - Add CVE-2008-1502.dpatch: upstream KSES lib fixes, thanks to Nico Golde.	Kees Cook	1.8.2-1.2ubuntu2	15 years ago
20	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - Suggest php5-ldap - Modify Maintainer value to match Debian-Maintainer-Field Spec - debian/postinst ucf fixes - drop use of wwwconfig (database code in postinst stolen from mythtv)	Oliver Grawert	1.8.2-1.2ubuntu1	16 years ago
19	debian/postinst: ... except we should explicitly pass --debc... debian/postinst: ... except we should explicitly pass --debconf-ok to ucf, for compatibility with older versions.	Steve Langasek	1.8.2-1ubuntu4	16 years ago
18	debian/postinst: Only call db_stop after ucf has been run in debian/postinst: Only call db_stop after ucf has been run in handle_config(), since ucf itself uses debconf; and drop the "exec 0<&1" workaround which no longer matters. LP: #203844	Steve Langasek	1.8.2-1ubuntu3	16 years ago
17	Package changed to avoid use of wwwconfig; borrowed database... Package changed to avoid use of wwwconfig; borrowed database setup code from Ubuntu mythtv package.	Matt Oquist	1.8.2-1ubuntu2	16 years ago
16	* Merge from Debian unstable. Remaining Ubuntu changes: * Merge from Debian unstable. Remaining Ubuntu changes: - Depends on postgresql-client - Suggest php5-ldap - Modify Maintainer value to match Debian-Maintainer-Field Spec	Vincent Legout	1.8.2-1ubuntu1	16 years ago
15	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - Depends on postgresql-client - Suggest php5-ldap - Set apache2 as default in debian/templates - Update Maintainer field in debian/control	Luca Falavigna	1.8.1-1ubuntu1	16 years ago
14	* Switch back to postgresql-client and postgresql (LP: 11005... * Switch back to postgresql-client and postgresql (LP: 110054) * Suggest php5-ldap (LP: 107713)	Luca Falavigna	1.7.2-1ubuntu2	17 years ago
13	* Merge from Debian unstable. Remaining Ubuntu changes: * Merge from Debian unstable. Remaining Ubuntu changes: + debian/control: - php5 by default. - Add postgresql-client-8.1 to Depends. - Update Recommends alternate to postgresql-8.1. + debian/templates: Ensure the default corresponds to the install- time dependencies (apache2). * Modify Maintainer value to match Debian-Maintainer-Field Spec	Arthur Loiret	1.7.2-1ubuntu1	17 years ago
12	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - debian/control: + php5 by default. + Add postgresql-client-8.1 to Depends. + Update Recommends alternate to postgresql-8.1. - debian/templates: Ensure the default corresponds to the install- time dependencies (apache2).	Kees Cook	1.6.3-2ubuntu1	17 years ago
11	* Merge from debian unstable. Remaining Ubuntu changes: * Merge from debian unstable. Remaining Ubuntu changes: - debian/control: + php5 by default. + Add postgresql-client-8.1 to Depends. + Update Recommends alternate to postgresql-8.1. - debian/templates: Ensure the default corresponds to the install- time dependencies (apache2).	Kees Cook	1.6.3-1ubuntu1	17 years ago
10	* SECURITY UPDATE: SQL injection vulnerability * SECURITY UPDATE: SQL injection vulnerability * Add '01_sql-injection-fix.dpatch': Correctly escape tag options. * References: CVE-2006-5219 http://cvs.moodle.com/blog/index.php?r1=1.18.2.2&r2=1.18.2.3	Kees Cook	1.6.2-1ubuntu1.1	17 years ago
9	* Merge from Debian unstable. The following Ubuntu changes r... * Merge from Debian unstable. The following Ubuntu changes remain: - debian/control: + Apply patch from Ubuntu #59472 to use php5 (Closes Ubuntu: #59472), + Add postgresql-client-8.1 to Depends (Closes Ubuntu: #51813), + Update Recommends alternate to postgresql-8.1, - debian/templates: Ensure the default corresponds to the install- time dependencies (apache2) so we can avoid the mess that was worked around in dapper-security.	Daniel T Chen	1.6.2-1ubuntu1	17 years ago
8	[ Ubuntu Merge-o-Matic ] [ Ubuntu Merge-o-Matic ] Merge from debian unstable.	Daniel T Chen	1.6-2ubuntu1	17 years ago
7	* Merge from debian unstable: * Merge from debian unstable: - Use Debian Sid's packaging save in debian/templates where we need to make sure the default corresponds to the install-time dependencies (apache2) so we can avoid the mess that was worked around in dapper-security.	Daniel T Chen	1.6-1ubuntu1	17 years ago
6	Resynchronise with Debian. Resynchronise with Debian.	Daniel T Chen	1.5.3+20060108-1ubuntu1	18 years ago
5	Resynchronise with Debian. Resynchronise with Debian.	Stephan Hermann	1.5.3-1ubuntu1	18 years ago
4	* Resync with debian (security update) * Resync with debian (security update) * changed dependencys to php5 * changed apache dependency to apache2 * References CAN-2005-2247	Andrew Mitchell	1.5.2-1ubuntu1	18 years ago
3	* Urgency high as upstream release fixes several security bu... * Urgency high as upstream release fixes several security bugs * New upstream release * Write database creation errors and warn the user about it, closes: #285842, #285842	Isaac Clerencia	1.4.3-1	19 years ago

Older »