Author: Luca Falavigna
Revision Date: 2012-12-23 14:53:41 UTC

* Non-maintainer upload.
* SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
  which allowed remote attackers to inject arbitrary web script or
  HTML via the query parameter.
  - debian/patches/CVE-2012-2253.patch
  - Closes: #695789

Author: Luca Falavigna
Revision Date: 2012-12-23 14:53:41 UTC

* Non-maintainer upload.
* SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
  which allowed remote attackers to inject arbitrary web script or
  HTML via the query parameter.
  - debian/patches/CVE-2012-2253.patch
  - Closes: #695789

Author: Luca Falavigna
Revision Date: 2012-12-23 14:53:41 UTC

* Non-maintainer upload.
* SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
  which allowed remote attackers to inject arbitrary web script or
  HTML via the query parameter.
  - debian/patches/CVE-2012-2253.patch
  - Closes: #695789

Author: Luca Falavigna
Revision Date: 2012-12-23 14:53:41 UTC

* Non-maintainer upload.
* SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
  which allowed remote attackers to inject arbitrary web script or
  HTML via the query parameter.
  - debian/patches/CVE-2012-2253.patch
  - Closes: #695789

Author: Luca Falavigna
Revision Date: 2012-12-23 14:53:41 UTC

* Non-maintainer upload.
* SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
  which allowed remote attackers to inject arbitrary web script or
  HTML via the query parameter.
  - debian/patches/CVE-2012-2253.patch
  - Closes: #695789

Author: Luca Falavigna
Revision Date: 2012-12-23 14:53:41 UTC

* Non-maintainer upload.
* SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
  which allowed remote attackers to inject arbitrary web script or
  HTML via the query parameter.
  - debian/patches/CVE-2012-2253.patch
  - Closes: #695789

Author: Luca Falavigna
Revision Date: 2012-12-23 14:53:41 UTC

* Non-maintainer upload.
* SECURITY UPDATE: Fix a cross-site scripting (XSS) vulnerability
  which allowed remote attackers to inject arbitrary web script or
  HTML via the query parameter.
  - debian/patches/CVE-2012-2253.patch
  - Closes: #695789

Author: Melissa Draper
Revision Date: 2012-07-16 09:37:07 UTC

* SECURITY UPDATE: Fix multiple cross-site scripting vulnerabilities
  - Sanitize json-encode login form when injected by js
  - Sanitize links in links and resources menu
  - Sanitize file description for blog image editor
  - Add escaping to user_display_name by adding to dwoo template
  - debian/patches/CVE-2012-2237-0001.patch: upstream patch
  - debian/patches/CVE-2012-2237-0002.patch: upstream patch
  - debian/patches/CVE-2012-2237-0003.patch: upstream patch
  - debian/patches/CVE-2012-2237-0004.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 00:11:15 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 00:23:05 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 14:43:12 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 01:38:40 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 14:43:12 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 01:38:40 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 00:23:05 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-21 00:11:15 UTC

* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation (LP: #958841)
  - debian/patches/saml_multi_default_config.patch: upstream patch

Author: Melissa Draper
Revision Date: 2012-03-14 01:53:32 UTC

* New upstream release
* SECURITY UPDATE: Fix default config for sites with multiple SAML instances
  - Default configuration changed to prevent impersonation

Author: François Marier
Revision Date: 2011-06-22 10:28:16 UTC

* New major upstream release
  - upstream .htaccess file has been removed

* Add missing (empty) build targets in debian/rules (lintian warning)

Author: François Marier
Revision Date: 2011-03-25 16:08:31 UTC

* New upstream security release:
  - CVE-2011-0439 (XSS in select boxes)
  - CVE-2011-0440 (CSRF when deleting blogs)

* Add Italian debconf translation (closes: #606378)
* Add Danish debconf translation (closes: #597766)
* Bump debhelper compatibility to 8

Author: François Marier
Revision Date: 2010-07-08 15:27:38 UTC

* SECURITY UPDATE: multiple cross-site scripting vulnerabilities
  - debian/patches/CVE-2010-1667.dpatch: upstream patch
  - CVE-2010-1667

* SECURITY UPDATE: multiple cross-site request forgery vulnerabilities
  - debian/patches/CVE-2010-1668.dpatch: upstream patch
  - CVE-2010-1668

* SECURITY UPDATE: SQL injection
  - debian/patches/CVE-2010-1669.dpatch: upstream patch
  - CVE-2010-1669

* SECURITY UPDATE: unsafe auth plugins configuration options
  - debian/patches/CVE-2010-1670.dpatch: upstream patch
  - CVE-2010-1670

* SECURITY UPDATE: IE-only cross-site scripting bug in HTML Purifier
  - depend on php-htmlpurifier and stop using the bundled version
  - CVE-2010-2479

Author: François Marier
Revision Date: 2010-07-08 15:27:38 UTC

* SECURITY UPDATE: multiple cross-site scripting vulnerabilities
  - debian/patches/CVE-2010-1667.dpatch: upstream patch
  - CVE-2010-1667

* SECURITY UPDATE: multiple cross-site request forgery vulnerabilities
  - debian/patches/CVE-2010-1668.dpatch: upstream patch
  - CVE-2010-1668

* SECURITY UPDATE: SQL injection
  - debian/patches/CVE-2010-1669.dpatch: upstream patch
  - CVE-2010-1669

* SECURITY UPDATE: unsafe auth plugins configuration options
  - debian/patches/CVE-2010-1670.dpatch: upstream patch
  - CVE-2010-1670

* SECURITY UPDATE: IE-only cross-site scripting bug in HTML Purifier
  - depend on php-htmlpurifier and stop using the bundled version
  - CVE-2010-2479

Author: François Marier
Revision Date: 2010-07-08 14:55:29 UTC

* SECURITY UPDATE: multiple cross-site scripting vulnerabilities
  - debian/patches/CVE-2010-1667.dpatch: upstream patch
  - CVE-2010-1667

* SECURITY UPDATE: multiple cross-site request forgery vulnerabilities
  - debian/patches/CVE-2010-1668.dpatch: upstream patch
  - CVE-2010-1668

* SECURITY UPDATE: unsafe auth plugins configuration options
  - debian/patches/CVE-2010-1670.dpatch: upstream patch
  - CVE-2010-1670

* SECURITY UPDATE: IE-only cross-site scripting bug in HTML Purifier
  - debian/patches/CVE-2010-2479.dpatch: upstream patch
  - CVE-2010-2479

Author: François Marier
Revision Date: 2010-07-08 14:55:29 UTC

* SECURITY UPDATE: multiple cross-site scripting vulnerabilities
  - debian/patches/CVE-2010-1667.dpatch: upstream patch
  - CVE-2010-1667

* SECURITY UPDATE: multiple cross-site request forgery vulnerabilities
  - debian/patches/CVE-2010-1668.dpatch: upstream patch
  - CVE-2010-1668

* SECURITY UPDATE: unsafe auth plugins configuration options
  - debian/patches/CVE-2010-1670.dpatch: upstream patch
  - CVE-2010-1670

* SECURITY UPDATE: IE-only cross-site scripting bug in HTML Purifier
  - debian/patches/CVE-2010-2479.dpatch: upstream patch
  - CVE-2010-2479

Author: François Marier
Revision Date: 2010-07-06 17:35:06 UTC

* Remove postgresql8.3 from recommends, add postgresql8.4
* Add mysql-server-5.1 to recommends

Author: François Marier
Revision Date: 2010-04-06 21:07:03 UTC

* New upstream release
  - fix for SQL injection (CVE-2010-0400)

Author: François Marier
Revision Date: 2009-04-22 17:13:39 UTC

* SECURITY UPDATE: cross-site scripting vulnerabilities in user profile
  field and text blocks in all views (LP: #364949)
  - debian/patches/CVE-2009-0664.dpatch: fix from upstream
  - CVE-2009-0664

Author: François Marier
Revision Date: 2008-06-25 16:52:34 UTC

[ Francois Marier ]
* Add Swedish debconf translation (closes: #487724). Thanks Martin!
* Remove outdated NEWS file

[ Nigel McNie ]
* New Upstream Version

Author: François Marier
Revision Date: 2009-06-22 15:17:25 UTC

* New Upstream Version
  - fixes multiple xSS vulnerabilities
  - fix for an information disclosure bug
* Bump Standards-Version to 3.8.2