~ubuntu-branches/ubuntu/maverick/mediawiki/maverick : changes

~ubuntu-branches/ubuntu/maverick/mediawiki/maverick » Changes from revision 28

From Revision 28 to 9

Rev	Summary	Authors	Tags	Date
28	[ Thorsten Glaser ] [ Thorsten Glaser ] * debian/patches/suppress_warnings.patch: new, suppress warnings about session_start() being called twice also in the PHP error log, not just MediaWiki’s, for example run from FusionForge [ Jonathan Wiltshire ] * New upstream security release: - correctly set caching headers to prevent private data leakage (closes: #590660, LP: #610782) - fix XSS vulnerability in profileinfo.php (closes: #590669, LP: #610819)	Jonathan Wiltshire	1:1.15.5-1	13 years ago
27	[ Thorsten Glaser ] [ Thorsten Glaser ] * debian/control: add Vcs-SVN and Vcs-Browser [ Jonathan Wiltshire ] * debian/source/format: Switch to source format 3.0 (quilt) * debian/rules: Drop CDBS quilt logic * debian_specific_config.patch: Don't just redefine MW_INSTALL_PATH, remove the original definition (LP: #406358) * debian/README.source: document use of quilt and format 3.0 (quilt) * New patch backup_documentation.patch improves documentation of maintenance/dumpBackup.php (closes: #572355) * Standards version 3.9.0 (no changes)	Jonathan Wiltshire	1:1.15.4-2	13 years ago
26	[ Jonathan Wiltshire ] [ Jonathan Wiltshire ] * New upstream security release (closes: #585918). * CVE-2010-1647: Fix a cross-site scripting (XSS) vulnerability which allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. * CVE-2010-1648: Fix a cross-site request forgery (CSRF) vulnerability in the login interface which allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form. [ Romain Beauxis ] * Put debian's package version in declared version. Should help sysadmins to keep track of installed versions, in particular with regard to security updates. * Added Jonathan Wiltshire to uploaders. * Do not clan math dir if it does not exist (for instance when running clean from SVN).	Romain Beauxis	1:1.15.4-1	13 years ago
25	* SECURITY UPDATE: A CSRF vulnerability was discovered in ou... * SECURITY UPDATE: A CSRF vulnerability was discovered in our login interface. Although regular logins are protected as of 1.15.3, it was discovered that the account creation and password reset features were not protected from CSRF. This could lead to unauthorised access to private wikis. (LP: #586773) - debian/patches/CSRF-Special-Userlogin-no-CVE_rev-66991.patch - patch from upstream SVN rev. 66991 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=23371 * SECURITY UPDATE: Noncompliant CSS parsing behaviour in Internet Explorer allows attackers to construct CSS strings which are treated as safe by previous versions of MediaWiki, but are decoded to unsafe strings by Internet Explorer. (LP: #586773) - debian/patches/XSS-IE-no-CVE_rev-66992.patch - patch from upstream SVN rev. 66992 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-May/000091.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=23687	Andreas Wenning	1:1.15.1-1ubuntu3	13 years ago
24	* SECURITY UPDATE: MediaWiki was found to be vulnerable to l... * SECURITY UPDATE: MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to login as the attacker, via a script on an external website. IMPORTANT: Fix includes a breaking change to the API login action. Any clients using it will need to be updated. (LP: #557159) - debian/patches/CSRF-no-CVE_rev-64680.patch - patch from upstream SVN rev. 64680 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-April/000090.html - https://bugzilla.wikimedia.org/show_bug.cgi?id=23076	Andreas Wenning	1:1.15.1-1ubuntu2	14 years ago
23	* SECURITY UPDATE: CSS validation issue allowing external im... * SECURITY UPDATE: CSS validation issue allowing external images to be included into wikis where that is disallowed by conf. (LP: #537974) - debian/patches/CSS-no-CVE_rev-63429.patch - patch from upstream SVN rev. 63429 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html * SECURITY UPDATE: Data leakage vulnerability in thumb.php affecting wikis which restrict access to private files using eg. img_auth.php. - debian/patches/DataLeakage-no-CVE_rev-63436.patch - patch from upstream SVN rev. 63436 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-March/000088.html	Andreas Wenning	1:1.15.1-1ubuntu1	14 years ago
22	* New upstream release. * New upstream release. * Ack previous NMU, thanks to Nico Golde for taking care of this.	Romain Beauxis	1:1.15.1-1	14 years ago
21	* Non-maintainer upload by the Security Team. * Non-maintainer upload by the Security Team. * Fix cross-site scripting in [[Special:Block]] (No CVE id yet; XSS-no-CVE.patch; Closes: #537634).	Nico Golde	1:1.15.0-1.1	14 years ago
20	* New upstream release. * New upstream release. * Upstream added support for OASIS documents. Closes: #530328 * Refreshed quilt patches * Bumped standards versions to 3.8.2 * Bumped compat to 7 * Pointed to GPL-2 in debian/copyright * Added php5-sqlite to possible DB backend dependencies. Closes: #501569 * Proofread README.Debian, upgrade is documented there. Closes: #520121	Romain Beauxis	1:1.15.0-1	14 years ago
19	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - Add debian/patches/add-OOo-Mimetypes.diff	Andreas Wenning	1:1.14.0-1ubuntu1	15 years ago
18	* SECURITY UPDATE: Multiple cross-site scripting (XSS) vulne... * SECURITY UPDATE: Multiple cross-site scripting (XSS) vulnerabilities in the web-based installer (config/index.php). (LP: #348858) - CVE-2009-0737 - debian/patches/CVE-2009-0737.patch - patch based on upstream patches for 1.13.4 and 1.13.5 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514547 - http://lists.wikimedia.org/pipermail/mediawiki-announce/2009-February/000083.html	Andreas Wenning	1:1.13.3-1ubuntu2	15 years ago
17	includes/mime.types: Add mimetypes for opendocument files (L... includes/mime.types: Add mimetypes for opendocument files (LP: #314220 ).	Thomas Bechtold	1:1.13.3-1ubuntu1	15 years ago
16	* New upstream release. * New upstream release. * Fix CVE-2008-5249: XSS vulnerability in MediaWiki: "An XSS vulnerability affecting all MediaWiki installations between 1.13.0 and 1.13.2." Closes: #508868 * Fix CVE-2008-5250: several local script injection vulnerabilities in MediaWiki: "o A local script injection vulnerability affecting Internet Explorer clients for all MediaWiki installations with uploads enabled. o A local script injection vulnerability affecting clients with SVG scripting capability (such as Firefox 1.5+), for all MediaWiki installations with SVG uploads enabled." Closes: #508869 * Fix CVE-2008-5252: CSRF vulnerability affecting the Special:Import feature in MediaWiki: "A CSRF vulnerability affecting the Special:Import feature, for all MediaWiki installations since the feature was introduced in 1.3.0." Closes: #508870	Romain Beauxis	1:1.13.3-1	15 years ago
15	* New upstream release * New upstream release * Fix CVE-2008-4408: XSS in mediawiki: "Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the useskin parameter to an unspecified component." Closes: #501115	Romain Beauxis	1:1.13.2-1	15 years ago
14	* Fixed postgresql dependency * Fixed postgresql dependency Closes: #472987 * Added instructions to install and upgrade Closes: #472990, #472831	Romain Beauxis	1:1.12.0-2	16 years ago
13	* Added patch to fix pgsql select, thanks to Marc Dequènes * Added patch to fix pgsql select, thanks to Marc Dequènes Closes: #469841 * Upated README.Debian to mention php5-gd instead of php5-gd2 and texlive-latex-base instead to tetex-bin. Closes: #469558 * still setting urgency to high since previous upload didn't make it to testing.	Romain Beauxis	1:1.11.2-2	16 years ago
12	* New upstream release * New upstream release * A potential XSS injection vector affecting Microsoft Internet Explorer users has been closed.	Romain Beauxis	1:1.11.1-1	16 years ago
11	Initial upload of 1.11.0 to unstable Initial upload of 1.11.0 to unstable	Romain Beauxis	1:1.11.0-2	16 years ago
10	* Switched to mediawiki1.10 * Switched to mediawiki1.10 * Mediawiki1.10 recommends mediawiki-math (Closes: #428021)	Romain Beauxis	1:1.10	16 years ago
9	* Switched to mediawiki1.9, closes: #392932 * Switched to mediawiki1.9, closes: #392932 * Corrected typo in control, closes: #414121 * Seperated -math extension to a single package, closes: #401714	Romain Beauxis	1:1.9	17 years ago

Older »