Mercurial > moin > 1.9

changeset 5903:e55effb840da

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
update docs/CHANGES
author Thomas Waldmann <tw AT waldmann-edv DOT de>
date Wed, 12 Dec 2012 12:04:34 +0100
parents 840ebd16ddd9
children 3a1b92276377
files docs/CHANGES
diffstat 1 files changed, 11 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/docs/CHANGES	Sun Dec 09 23:20:50 2012 +0100
+++ b/docs/CHANGES	Wed Dec 12 12:04:34 2012 +0100
@@ -16,7 +16,7 @@
     editor_force = True
     editor_default = 'text'  # internal default, just for completeness
 
-Version 1.9.5:
+Version 1.9.<current>:
 
   SECURITY HINT: make sure you have allow_xslt = False (or just do not use
   allow_xslt at all in your wiki configs, False is the internal default).
@@ -25,6 +25,16 @@
   HINT: Python >= 2.5 is maybe required! See docs/REQUIREMENTS for details.
 
   Fixes:
+  * fix XSS issue, escape page name in rss link
+  * escape user- or admin-defined css url
+  * make taintfilename more secure
+  * use a constant time str comparison function to prevent timing attacks
+  * Attachment handler: catch all Zip-related errors
+
+
+Version 1.9.5:
+
+  Fixes:
    * Security fix: fix virtual group bug in ACL evaluation.
    * Avoid crash if #refresh processing instruction is used without arguments.
    * Fix issue with non-ASCII textchas.