Change log for dokuwiki package in Debian

dokuwiki (0.0.20220731.a-2) unstable; urgency=high

  * Cherry pick upstream 2022-07-31b hotfix patches for the Igor release:
    + ba76f875: fix XSS in RSS syntax
    + b7fcf218: hotfix release for Igor
    Closes: #1036279

 -- Axel Beckert <email address hidden>  Sun, 21 May 2023 15:01:45 +0200

Available diffs

• diff from 0.0.20220731.a-1 to 0.0.20220731.a-2 (2.0 KiB)

dokuwiki (0.0.20220731.a-1) unstable; urgency=medium

  * Salvage package. (Closes: #1008649)
    + Set Maintainer to the Debian Dokuwiki Team and set Anton Gladky and
      myself as Uploaders.
    + Upload to unstable again.
  * Import new upstream release »2022-07-31a “Igor”«
    + Drop patch add_vesion_to_snapshot.diff. (Just needed for packaging
      snapshots.)
    + Refresh debianize.diff.
    + Drop support for PHP versions earlier than 7.2. → Add according
      version constraint to the php dependency.
    + Fixes CVE-2022-28919 XSS vulnerability via the function
      _generateFilename. (Closes: #1011056)
    + Fixes a vulnerability in diff viewer (Github issue #3761)
    + More PHP8-related fixes. (Closes: #974961)
    + Disable "testing" plugin by default by setting its directory to be
      only accessible by root. Add lintian override for that.
    + postinst + dokuwiki-addsite: Handle creation of per-animal data/log
      directories in farms,
    + Add a NEWS.Debian entry mentioning the need to manually create
      per-animal log directories in farm setups which don't use standard
      paths.
    + debian/copyright: Drop now obsolete vendor/paragonie/random_compat
      stanza. Also drop now unneeded Artistic license. Thanks Lintian!
    + Update path and license of the IXR library in debian/copyright.
    + Merge debian/copyright stanzas for vendor/splitbrain/php-archive/*,
      vendor/splitbrain/php-cli/* and the new vendor/splitbrain/slika/*
      into simply vendor/splitbrain/* and update copyright years.
  * Bracketize lintian overrides.
  * Add a debian/.gitignore file.
  * Run "wrap-and-sort -a".
  * Replace debian/compat with versioned dependency on debhelper-compat
    and switch from compat level 11 to 13.
  * Add missing dependency on ${perl:Depends} for DEBIAN/config.
  * Declare compliance with Debian Policy 4.6.1.
  * Add lintian overrides for translations of help page.
  * Don't ship .gitignore or .gitattributes files in the resulting .deb
    package. Also drop redundant license files from the resulting .deb.
  * Add more lintian overrides for DokuWiki's *.info.txt metadata files.
  * Bump debian/watch version from 3 to 4. Thanks Lintian!
  * debian/copyright: Reflow CC-BY-3.0 license. (Removes overlong lines.)
  * Checked all other occurrences of the lintian warning
    very-long-line-length-in-source-file and added commented overrides.

 -- Axel Beckert <email address hidden>  Mon, 14 Nov 2022 04:24:11 +0100

Available diffs

• diff from 0.0.20200729-0.1 to 0.0.20220731.a-1 (473.9 KiB)

dokuwiki (0.0.20220317~gitaeff85c-0.1~exp1) experimental; urgency=medium

  * [885580e] Add .gitlab-ci.yml
  * [269c785] New upstream version 0.0.20220317~gitaeff85c
  * [708ec46] Update patches

 -- Anton Gladky <email address hidden>  Tue, 29 Mar 2022 23:40:29 +0200

dokuwiki (0.0.20200729-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream release. (Closes: #968453, #970926)
    + Support for PHP 8. (Closes: #1004330)
    + Refresh all patches.
    + Drop no more needed stanzas from debian/copyright. Thanks Lintian!
    + Update copyright years in debian/copyright.
  * Add a debian/gbp.conf to document the non-standard upstream branch.
  * Upgrade Homepage header to HTTPS.
  * Cherry-pick upstream commit 6b6d27d9 to avoid 500 server error in
    lessc.inc.php.
  * debian/postinst: Replace all occurrences of tempfile with mktemp.
    (Closes: #994877)
  * Add symlinks for phpseclib and random-compat under
    /usr/share/dokuwiki/vendor/. See comment in #1004330.
  * Add lintian overrides for wiki pages, translations and similar files
    triggering package-contains-documentation-outside-usr-share-doc.
  * Remove no more emitted lintian overrides, partially also because of
    the new upstream release which no more ships some affected files.
  * debian/{watch,postrm}: Convert comments from ISO-8859 to UTF-8.

 -- Axel Beckert <email address hidden>  Sun, 13 Mar 2022 22:53:27 +0100

Available diffs

• diff from 0.0.20180422.a-2.1 to 0.0.20200729-0.1 (1.1 MiB)

dokuwiki (0.0.20180422.a-2.1) unstable; urgency=medium

  * Non maintainer upload by the Reproducible Builds team.
  * No source change upload to rebuild on buildd with .buildinfo files.

 -- Holger Levsen <email address hidden>  Sat, 02 Jan 2021 15:28:29 +0100

Available diffs

• diff from 0.0.20180422.a-2 to 0.0.20180422.a-2.1 (368 bytes)

dokuwiki (0.0.20180422.a-2) unstable; urgency=medium

  * debian/control:
    - depend on versioned php-phpseclib (>=2).  (Closes: #909283)
    - remove Mohammed Adnène Trojette from Maintainers, on his statement.
  * debian/add-ons/button-debian.png: restore debian button that was dropped
    at some point (thanks to Reinhard Tartler). (Closes: #857807)
  * debian/source/local-options: remove, to allow building with dgit (thanks
    to Reinhard Tartler).
  * debian/po/pt.po: update Portuguese translation, thanks to Rui Branco.
    (Closes: #858653)

 -- Tanguy Ortolo <email address hidden>  Wed, 26 Sep 2018 17:08:00 +0200

Available diffs

• diff from 0.0.20180422.a-1 to 0.0.20180422.a-2 (1.8 KiB)

dokuwiki (0.0.20180422.a-1) unstable; urgency=medium

  * New upstream release. (Closes: #892976)
  * Acknowledge NMU 0.0.20160626.a-2.1, thanks to Reinhard Tartler.
    (Closes: #903305)
  * debian/patches: refresh and update patches
    - use_packaged_simplepie.diff: refresh, and patch the static autoloader.
    - use_packaged_php-geshi_SA32559.diff: refresh and patch the static
      autoloader.
    - use_packaged_php-seclib.diff: patch the Composer loader, which is
      now used for this dependency.
    - debianize.diff: no longer needed to patch the installation file with our
      main configuration file checksum; refresh.
    - soften_email_validator.diff: no longer needed.
    - use_packaged_jquery.diff: jquery is now loaded from two files.
    - filter-special-chars-from-ajax-call-para: removed, applied upstream.
    - fix-loading-of-css-closes-894018: removed, applied upstream.
    - use_packaged_php-random-compat.diff: use the packaged version of
      the new dependency php-random-compat.
  * debian/control:
    - depend on php-phpseclib which is the successor of php-seclib.
    - depend on php-random-compat.
    - depend on debhelper >= 11.
    - switch VC to Salsa <https://salsa.debian.org/>.
    - update Standards-Version to 4.2.1 (no change needed).
  * debian/compat: use debhelper compatibility level 11.
  * debian/rules:
    - remove new bundled libraries as we use packaged ones whenever possible.
    - minify jequery-migrate.js from packaged missing source, since upstream
      stopped shipping it.
    - removed bundled library's license and readme files, which are not useful
      for users (they are for people interested in the source).
  * debian/copyright:
    - update with new licenses and new bundled libraries.
    - switch the format URI to HTTPS.
  * debian/missing-sources/lib/scripts/jquery/jquery-migrate.js: add missing
    source file for minified javascript.
  * debian/source/lintian-overrides: add overrides about prebuilt
    JavaScript files, and remove now unused ones.
  * debian/upstream/metadata: add this UMEGAYA file.

 -- Tanguy Ortolo <email address hidden>  Thu, 12 Jul 2018 10:36:51 +0200

Available diffs

• diff from 0.0.20160626.a-2.1 to 0.0.20180422.a-1 (3.1 MiB)

dokuwiki (0.0.20160626.a-2.1) unstable; urgency=medium

  * Non-maintainer upload.
  * CVE-2017-18123: fix remote code execution through reflected file
    download. Originally prepared by  Antoine Beaupré <email address hidden>
    (Closes: #889281)
  * Fix loading of css (Closes: #894018)
  * Fix 'Invalid argument supplied for foreach() .../lib/exe/js.php'
    (Closes: #866245)

 -- Reinhard Tartler <email address hidden>  Sat, 07 Jul 2018 11:59:53 -0400

Available diffs

• diff from 0.0.20160626.a-2 to 0.0.20160626.a-2.1 (1.6 KiB)

dokuwiki (0.0.20160626.a-2) unstable; urgency=medium

  * debian/control: depend on php-seclib (<<2) as the new php-phpseclib
    provides php-seclib (>= 2) which is not compatible.

 -- Tanguy Ortolo <email address hidden>  Fri, 14 Apr 2017 15:23:13 +0200

Available diffs

• diff from 0.0.20160626.a-1 to 0.0.20160626.a-2 (482 bytes)

dokuwiki (0.0.20160626.a-1) unstable; urgency=medium

  * New upstream release. (Closes: #834150)
  * debian/patches/debianize.diff: refresh and update with new configuration
    file checksum.
  * debian/copyright: update and correct
     - remove paragraph for inc/cliopts.php which no longer exists.
     - correct license of inc/SimplePie.php which is mostly under BSD-3-clause
       but contains a part under BSD-2-clause.
  * debian/dokuwiki.lintian-overrides: override warnings about missing PHP CLI
    dependency, which is in Recommends.
  * debian/watch: switch to HTTPS for retreiving upstream tarball.

 -- Tanguy Ortolo <email address hidden>  Sun, 14 Aug 2016 11:39:12 +0200

Available diffs

• diff from 0.0.20150810.a-2 to 0.0.20160626.a-1 (421.1 KiB)

dokuwiki (0.0.20150810.a-2) unstable; urgency=medium

  * debian/control:
     + depend on php* rather than php5-*. (Closes: #821478)
     + depend on php-xml, which functions have been split from the  base php
       package.
     + update Standards-Version to 3.9.8 (no change needed).
  * debian/po/pt_BR.po: new Brazilian template translation, thanks to Adriano
    Rafael Gomes. (Closes: #816933)
  * debian/rules: remove dummy files that are useless for Debian packages.
    (Closes: #800540)
  * debian/source/lintian-overrides: add overrides, as the long lines in two
    JavaScript files are not really abnormal.

 -- Tanguy Ortolo <email address hidden>  Mon, 09 May 2016 11:09:02 +0200

Available diffs

• diff from 0.0.20140929.d-1ubuntu1 (in Ubuntu) to 0.0.20150810.a-2 (2.1 MiB)

dokuwiki (0.0.20150810.a-1) unstable; urgency=medium

  * New upstream release. (Closes: #797105)
  * debian/patches: refresh patches
     + use_packaged_jquery.diff: now bundled with Composer, which loader had
       to be patched instead of DokuWiki's.
  * debian/source/lintian-overrides:
     + ignore a false positive about a JavaScript that seems minified but is
       not (it only contains two long lines).
     + ignore warnings about a minified JavaScript which we now rebuild
       ourselves.
  * debian/control:
     + line-break and order dependencies.
     + build-depend on slimit to minify some JavaScript files.
     + build-depend on debhelper 9.
     + update Vcs-* URLs to HTTPS ones.
     + update Standards-Version to 3.9.7 (no change needed).
  * debian/rules:
     + minify lib/scripts/jquery/jquery-migrate.js ourselves.
     + remove geshi from /usr/share/dokuwiki/vendor since it is now installed
       there.
     + remove redundant license file for vendor/splitbrain/php-archive (already
       documented in debian/copyright).
  * debian/compat: declare a compatibility level of 9.
  * debian/copyright:
     + correct a minor grammar error ("does not allow *the author* to).
     + update for TarLib.php's renaming to Tar.php.
     + add copyright information for libraries in the vendor directory.
  * debian/postinst, debian/postrm: use `command -v` (which *is* POSIX,
    contrary to what the devref seems to indicate) to check for the existence
    of some commands, rather than `test -x` with their full path.
  * debian/postrm: remove plugin configuration on purge.
  * debian/install: install the vendor directory to /usr/share/dokuwiki.

 -- Tanguy Ortolo <email address hidden>  Thu, 25 Feb 2016 12:59:59 +0100

dokuwiki (0.0.20140505.a+dfsg-4) testing-proposed-updates; urgency=high


  * debian/patches: security fix, from upstream hotfix release
     + cve-2015-2172_check_permissions_in_rpc.patch: check permissions in the
       ACL plugin's RPC API to avoid a privilege escalation. (CVE-2015-2172)
       (Closes:  #779547)

 -- Tanguy Ortolo <email address hidden>  Sun, 22 Mar 2015 17:40:22 +0100

dokuwiki (0.0.20140929.d-1) unstable; urgency=medium


  * New upstream hotfix releases:
     + prevent XSS attack via SWF uploads. (CVE-2014-9253) (Closes: #773429)
     + fix privilege escalation in RPC API (CVE-2015-2172) (Closes: #779547)
     + fix an XSS vulnerability in the user manager (Closes: #780817)

 -- Tanguy Ortolo <email address hidden>  Sun, 22 Mar 2015 17:00:41 +0100

Available diffs

• diff from 0.0.20140929.a-1 to 0.0.20140929.d-1 (1.8 KiB)

dokuwiki (0.0.20120125b-2+deb7u1) wheezy-security; urgency=medium


  * debian/patches:
     + fix_ldap_auth_bypass_CVE-2014-8763.diff: fix an authentication bypass
       flaw when using Active Directory for LDAP
       authentication. (CVE-2014-8763)
     + fix_media_acl_bypass_CVE-2014-8762.diff: fix a media ACL bypass flaw.
       (CVE-2014-8761, CVE-2014-8762)

 -- Tanguy Ortolo <email address hidden>  Wed, 29 Oct 2014 09:23:25 +0100

dokuwiki (0.0.20140929.a-1) unstable; urgency=high


  * New upstream release:
     + security fix for AD/LDAP auth plugin related problem (CVE-2014-8764). 
  * debian/copyright: no longer exclude two non-free files, as they were
    replaced upstream by my free alternatives.
  * debian/control: update Standards-Version to 3.9.6 (no change needed).
  * debian/po/nl.po: Dutch translation, thanks to Frans Spiesschaert. (Closes:
    #764188)

 -- Tanguy Ortolo <email address hidden>  Tue, 28 Oct 2014 13:15:20 +0100

Available diffs

• diff from 0.0.20140505.a+dfsg-3 to 0.0.20140929.a-1 (680.5 KiB)

dokuwiki (0.0.20140505.a+dfsg-3) unstable; urgency=medium


  * debian/config: only set a default password if the question was skipped
    /and/ the stored value is empty. (Closes: #763053)
  * debian/copyright: update the path to adLDAP, which has been moved in the
    source tree.

 -- Tanguy Ortolo <email address hidden>  Sun, 05 Oct 2014 21:48:26 +0200

Available diffs

• diff from 0.0.20140505+dfsg-1 to 0.0.20140505.a+dfsg-3 (4.4 KiB)

dokuwiki (0.0.20140505.a+dfsg-2) unstable; urgency=medium


  * debian/dokuwiki.cron.daily:
     - correct a failure for non-existent directory in newly installed wikis.
     - minor variable naming adjusment for more consistency.

 -- Tanguy Ortolo <email address hidden>  Tue, 26 Aug 2014 12:13:10 +0200

dokuwiki (0.0.20140505.a+dfsg-1) experimental; urgency=medium


  * New upstream hotfix release.
  * debian/copyright: correct syntax to exclude two non-free files
    (it is Files-Excluded, not Exclude).
  * debian/README.Debian:
     - correct a dead HTTP link. (Closes: #752676)
     - document the new default password for insane debconf configurations.
  * debian/watch: add a . (dot) before the patch level in the Debian version
    number (this is because 0.0.20140505a+dfsg-1 < 0.0.20140505+dfsg-1!).
  * debian/dokuwiki.cron.daily: add a cron job to do cleanup and, if
    configured, spam blacklist update. (Closes: #756050)
  * debian/dokuwiki.default: add a configuration file for the cleanup and spam
    blacklist update cron job.
  * debian/control: add wget to Recommends as it would be needed for spam
    blacklist update.
  * debian/config: change priority of webservers to configure (now medium) and
    add a default admin password for insane installations where debconf is
    configured to ignore even high priority questions)

 -- Tanguy Ortolo <email address hidden>  Mon, 25 Aug 2014 14:50:16 +0200

dokuwiki (0.0.20140505+dfsg-1) unstable; urgency=medium


  * New upstream release.
  * debian/patches: refresh, as lines changed, but no effective change.
  * debian/copyright:
     - exclude two non-free files.
       (see <https://wiki.debian.org/UscanEnhancements> for more information
       about that uscan feature)
     - add information about two new images (public domain).
  * debian/add-ons/{disabled,enabled}.png: include two alternative icons to
    replace the non-free ones originally included in the upstream tarball.
  * debian/install: install these two icons.
  * debian/watch: ignore the "+dfsg" part when looking for the upstream
    tarball.
  * debian/rules: remove a license information file (information is already
    provided in debian/copyright).

 -- Tanguy Ortolo <email address hidden>  Sun, 08 Jun 2014 16:12:20 +0200

Available diffs

• diff from 0.0.20131208-2 to 0.0.20140505+dfsg-1 (765.9 KiB)

dokuwiki (0.0.20131208-2) unstable; urgency=medium


  * debian/config: when no webserver was chosen, skip the question of whether
    or not to restart the webserver. (Closes: #742795)
  * debian/source/lintian-overrides: ignore two minified JS files as packages
    versions are used instead (so they are neither installed nor used).
  * debian/po: include new template translations
     + da.po: Danish translation, thanks to Joe Hansen. (Closes: #739764)
  * debian/add-ons/dokuwiki-addsite (and manpage): add an option not to create
    an admin user and ask for a password, to allow non-interactive runs.
    (Closes: #736271)

 -- Tanguy Ortolo <email address hidden>  Fri, 18 Apr 2014 15:10:28 +0200

Available diffs

• diff from 0.0.20131208-1 to 0.0.20131208-2 (3.2 KiB)

dokuwiki (0.0.20131208-1) unstable; urgency=medium


  * New upstream release. (Closes: #733625)
  * debian/watch: update for new upstream release page.
  * debian/patches/*: refresh.
     + fhs.diff: remove, no longer needed.
     + use_packaged_php-seclib.diff: use packaged php-seclib instead of the
       embedded one.
  * lib/tpl/default/images/button-debian.png: moved to
    lib/tpl/dokuwiki/images/ as the default template has been renamed from
    "default" to "dokuwiki".
  * debian/control:
     + update Standards-Version (no change needed).
     + depend on php-seclib
  * debian/copyright: indicate embedded phpseclib license.
  * debian/rules: remove embedded php-seclib.
  * debian/po: include new template translations
     + fr.po: correct important mistakes and incoherences in license name
       translations.
     + ja.po: Japanese translation, thanks to Hideki Yamane. (Closes: #730564)
     + es.po: Spanish translation, thanks to Matías Bellone. (Closes: #733732)

 -- Tanguy Ortolo <email address hidden>  Sat, 04 Jan 2014 13:37:00 +0100

Available diffs

• diff from 0.0.20130510a-4 to 0.0.20131208-1 (478.5 KiB)

dokuwiki (0.0.20130510a-4) unstable; urgency=low


  * debian/po: include new template translations
     + fr.po: French translation, thanks to Steve Petruzzello.
       (Closes: #728770)
     + de.po: German translation, thanks to Holger Wansing. (Closes: #729176)
     + pl.po: Polish translation, thanks to Michał Kułach. (Closes: #730060)
     + it.po: Italian translation, thanks to Daniele Forsi. (Closes: #729753)

 -- Tanguy Ortolo <email address hidden>  Sun, 24 Nov 2013 17:33:13 +0100

Available diffs

• diff from 0.0.20130510a-3 to 0.0.20130510a-4 (8.4 KiB)

dokuwiki (0.0.20130510a-3) unstable; urgency=low


  * debian/postinst: remove possible user-defined symlink for apache 2.4
    compatibility now this package supports it. (Closes: #728199)
  * debian/po: include new template  translations
     + ru.po: Russian translation, thanks to Yuri Kozlov. (Closes: #728211)
     + sv.po: Swedish translation, thanks to Martin Bagge. (Closes: #728076)
     + cs.po: Czech translation, thanks to Miroslav Kure. (Closes: #728102)

 -- Tanguy Ortolo <email address hidden>  Tue, 29 Oct 2013 21:45:42 +0100

Available diffs

• diff from 0.0.20130510a-2 to 0.0.20130510a-3 (2.0 KiB)

dokuwiki (0.0.20130510a-2) unstable; urgency=low


  * debian/control: recommend php5-ldap | php5-mysql | php5-pgsql to reflect
    the fact that alternative authentication systems use only one of them.
    (Closes: #718851)
  * debian/postinst, debian/postrm:
     + adapt to apache2 >= 2.4. (Closes: #727140)
     + ignore lighty-disable-mod failures, in cases where dokuwiki was not
       installed for lighttpd. (Closes: #712307)
     + stop debconf to avoid stalling forever if lighttpd had to be restarted.
       (see #133029)
     + ignore invoke-rc.d lighttpd failures, in cases where lighttpd is not
       running (this may be a problem, but not this package's one, so no
       reason to abort installation or removal)
     + disable webserver configuration on remove rather than on purge, since
       it makes no sense to keep a webserver configured for a wiki that has
       been removed (the webserver configuration files are still kept in
       /etc/dokuwiki, only their enabling symlinks are removed).
  * debian/templates: mention that the user can define and choose his own
    license after the installation. (Closes: #721941)
  * debian/po: refresh translation files for the templates modification.

 -- Tanguy Ortolo <email address hidden>  Sun, 27 Oct 2013 18:34:38 +0100

Available diffs

• diff from 0.0.20130510a-1 to 0.0.20130510a-2 (5.8 KiB)

dokuwiki (0.0.20130510a-1) unstable; urgency=low


  * New upstream release.
  * debian/control:
     + add php5-ldap, php5-mysql and php5-pgsql to Recommends, as they are
       needed for included authentication backends. (Closes: #706853)
     + update Standards-Version (no change needed).
     + use canonical VCS URLs.
  * debian/patches/*: refresh.
     + debianize.diff: replace “run by Debian” by “run on Debian” to avoid
       ambiguity. (Closes: #711362)
  * debian/rules: keep a jquery module which is not provided by any other
    package.
  * debian/copyright: include license information for jquery.

 -- Tanguy Ortolo <email address hidden>  Wed, 19 Jun 2013 22:51:17 +0200

Available diffs

• diff from 0.0.20120125b-2 to 0.0.20130510a-1 (1.5 MiB)

dokuwiki (0.0.20121013-1) experimental; urgency=low


  * New upstream release.
  * debian/postinst: do not include a timestamp in the generated conffiles.
    (Closes: #696864)
  * debian/add-ons/dokuwiki-addsite: correct ACL and password file
    permissions. (Closes: #697927)
  * debian/patches/*: refresh; some manual adaptation was required due to
    context change but no actual patch change was needed.
  * debian/copyright: add the missing default Files paragraph and add a Files
    paragraph for new icons licensed under CC-BY-SA-3.0.
  * debian/rules: remove useless licensing information files (we document
    licensed in debian/copyright).
  * debian/postrm: on page purge, also remove media metainfo and old
    revisions.

 -- Tanguy Ortolo <email address hidden>  Mon, 21 Jan 2013 23:20:39 +0100

dokuwiki (0.0.20120125b-2) unstable; urgency=low


  * debian/add-ons/dokuwiki-addsite: correct a bashism `read -p "…"`.
    (Closes: #690650)

 -- Tanguy Ortolo <email address hidden>  Fri, 19 Oct 2012 22:45:45 +0200

Available diffs

• diff from 0.0.20120125b-1 to 0.0.20120125b-2 (584 bytes)

dokuwiki (0.0.20120125b-1) unstable; urgency=high


  * New upstream bugfix release: sanitize a POST parameter that could be used
    to inject artitrary HTML and JavaScript, leading to an XSS vulnerability.
    (CVE-2012-0283) (Closes: #683378)

 -- Tanguy Ortolo <email address hidden>  Wed, 15 Aug 2012 11:46:36 +0200

Available diffs

• diff from 0.0.20120125a-1 to 0.0.20120125b-1 (1.0 KiB)

dokuwiki (0.0.20120125a-1) unstable; urgency=high


  * New upstream bugfix release: properly escape an error messages that could
    be used to inject arbitrary JavaScript, leading to an XSS vulnerability.
    (CVE-2012-2129) (Closes: 670917)

 -- Tanguy Ortolo <email address hidden>  Sat, 05 May 2012 14:27:37 +0200

Available diffs

• diff from 0.0.20120125-2 to 0.0.20120125a-1 (801 bytes)

dokuwiki (0.0.20120125-2) unstable; urgency=low


  * debian/addons/dokuwiki-addsite: add missing directories, thanks to monica.
    (Closes: #666689)
  * debian/rules: add missing (empty) configuration file, thanks to monica.
    (Closes: #664864)
  * debian/copyright:
     + update to release format.
     + remove extra indentation on license paragraphs.
     + use standard license names BSD-2-clause and BSD-3-clause.
     + update copyright information and dates.
     + remove info on files that no longer exist (Flash applet).
  * debian/rules: remove the Flash removal lines (the corresponding files is
    no longer part of DokuWiki).
  * debian/README.Debian: remove instructions for Flash uploading tool (they
    are no longer relevant).
  * debian/control: update Standards-Version (no change required).

 -- Tanguy Ortolo <email address hidden>  Sun, 15 Apr 2012 15:46:06 +0200

Available diffs

• diff from 0.0.20110525a-2 to 0.0.20120125-2 (527.0 KiB)

dokuwiki (0.0.20080505-4+lenny4) oldstable-security; urgency=low


  * debian/patches/rss_security.diff: avoid calling an undefined function.
    (Closes: #644145)

 -- Tanguy Ortolo <email address hidden>  Thu, 06 Oct 2011 21:03:07 +0200

dokuwiki (0.0.20120125-1) unstable; urgency=low


  * New upstream release.
  * debian/patches/debianize.diff: updated for the new release.

 -- Tanguy Ortolo <email address hidden>  Thu, 26 Jan 2012 23:10:28 +0100

dokuwiki (0.0.20111110~rc1-1) experimental; urgency=low


  * New upstream release candidate.
  * debian/patches/*: refresh and add Forwarded: not-needed fields since these
    are really Debian-specific patches.
  * debian/changelog.upstream: update from <http://www.dokuwiki.org/changes>.
  * debian/patches/use_packaged_jquery.diff: patch to use the packaged version
    of jQuery instead of an embedded one, except the (modified) CSS.
  * debian/control: depend on the needed jQuery packages and
    javascript-common.
  * debian/rules: remove the embedded copy of jQuery, except the (modified)
    CSS.
  * debian/dokuwiki.lintian-overrides: remove leading slash on some paths to
    acomodate a lintian change.

 -- Tanguy Ortolo <email address hidden>  Tue, 03 Jan 2012 00:31:56 +0100

dokuwiki (0.0.20091225c-10+squeeze2) stable; urgency=low


  * debian/patches/rss_security.diff: Backport an upstream security fix for
    an XSS vulnerability in the RSS embedding mechanism. (CERTA-2011-AVI-366)

 -- Tanguy Ortolo <email address hidden>  Wed, 29 Jun 2011 01:46:43 +0200

dokuwiki (0.0.20080505-4+lenny3) oldstable; urgency=low


  * debian/patches/rss_security.diff: Backport an upstream security fix for an
    XSS vulnerability in the RSS embedding mechanism. (CERTA-2011-AVI-366)

 -- Tanguy Ortolo <email address hidden>  Sun, 26 Jun 2011 13:23:05 +0200

dokuwiki (0.0.20110525a-2) unstable; urgency=low
  * debian/postinst: check that /etc/dokuwiki/htaccess exists before sed'ing    it. (Closes: #632927) -- Tanguy Ortolo <email address hidden>  Tue, 19 Jul 2011 23:54:38 +0200

dokuwiki (0.0.20110525a-1) unstable; urgency=low
  * New bugfix upstream version: fixes an RSS-related XSS case.  * debian/postrm: split in two a double (existent + stat) test against    /var/lib/dokuwiki/farm, to skip the second test that would issue an error    message if it does not exist. -- Tanguy Ortolo <email address hidden>  Sun, 26 Jun 2011 11:58:57 +0200

dokuwiki (0.0.20091225c-10+squeeze1) stable; urgency=low
  * debian/README.Debian: Correct a spelling error.  * debian/patches/xmlrpc_security.diff: Backport an upstream security fix for    an ACL bypass (TEMP-0000000-52FF39). -- Tanguy Ortolo <email address hidden>  Wed, 16 Mar 2011 21:02:46 +0100

dokuwiki (0.0.20110525-1) unstable; urgency=low
  * New upstream version. (Closes: #603390)  * Upload to unstable now that the multi-site and single-site modes have been    tested.  * Install examples with dh_installexamples and manpages with    dh_installman.  * debian/patches:     + workaround_simplepie.diff: removed as no longer needed.     + debianize.diff: refreshed for new config file hash.     + license_tarlib.diff: removed as no longer needed.     + soften_email_validator.diff: refresh (now a single variable allows one       to allow domain name parts with no dot).  * debian/README.Debian: document the way to disable plugins for a specific    site (not enabled by default because it implied replacing the normal    plugin controller). (Closes: #628221) -- Tanguy Ortolo <email address hidden>  Fri, 10 Jun 2011 22:45:03 +0200

dokuwiki (0.0.20101107a-4) experimental; urgency=low
  * debian/po/*.po: debconf template translation refresh and update     + French, thanks to Steve Petruzzello. (Closes: #623824)     + German, thanks to Holger Wansing. (Closes: #625263)     + Galician, thanks to Miguel Bouzada. (Closes: #626425)  * debian/rules: add new directories, reorder and comment.  * debian/dokuwiki.lintian-overrides: new data directories with non-standard    permissions (private, thus 700).  * Multisite support and helper dokuwiki-addsite(1). (Closes: #331499) -- Tanguy Ortolo <email address hidden>  Wed, 18 May 2011 01:27:01 +0200

dokuwiki (0.0.20101107a-3) unstable; urgency=low
   * debian/po/*.po: deconf template translation update     + Portuguese, thanks to Rui Branco. (Closes: #622748)     + Russian, thanks to Yuri Kozlov. (Closes: #622792)     + Basque, thanks to Dooteo. (Closes: #622891)     + Danish, thanks to Joe Hansen. (Closes: #622985)     + Swedish, thanks to Martin Bagg. (Closes: #623409)     + Spanish, thanks to Francisco Javier Cuadrado. (Closes: #624282)     + Dutch, thanks to Jeroen Schot. (Closes: #624517)     + Japanese, thanks to Hideki Yamane. (Closes: #624620)     + Czech, thanks to Miroslav Kure. (Closes: #625708)  * debian/po/*: debconf template translation refresh.  * debian/control: updated Standards-Version (no change required).  * debian/postinst: escape single quotes and backslashes in the wiki title.    (Closes: #616488)  * debian/dokuwiki.lintian-overrides: override three experimental warnings    about broken symlinks that point to ucf-generated conffiles that are not    part of the package.  * debian/templates: fold a multiline Choices field to a single line, as    debconf does not seem to interprete it correctly. -- Tanguy Ortolo <email address hidden>  Sun, 08 May 2011 23:01:22 +0200

dokuwiki (0.0.20101107a-2) unstable; urgency=low
  * debian/templates: corrected debconf templates after review.  * debian/po/fr.po: deconf template translation update     + French, thanks to Steve Petruzzello. (Closes: #619094) -- Tanguy Ortolo <email address hidden>  Wed, 13 Apr 2011 22:05:05 +0200

dokuwiki (0.0.20101107a-1) unstable; urgency=low
  * New upstream release:    security fix for an ACL bypass (TEMP-0000000-52FF39).  * debian/dokuwiki.lintian-overrides: let dh_lintian install lintian    overrides.  * debian/install: stop using dh_install manually configured to install    lintian overrides.  * debian/README.Debian: correct a spelling error. -- Tanguy Ortolo <email address hidden>  Wed, 09 Mar 2011 22:44:12 +0100

dokuwiki (0.0.20101107-2) unstable; urgency=low
  * Upload to unstable.  * debian/templates: some errors correction.  * debian/po/*.po: debconf-updatepo. -- Tanguy Ortolo <email address hidden>  Thu, 24 Feb 2011 20:51:24 +0100

dokuwiki (0.0.20101107-1) experimental; urgency=low
  * New upstream release. (Closes: #531534, #549527)  * debian/control: suggest libapache2-mod-xsendfile as it can allow DokuWiki    to directly serve media files instead of delivering them through PHP (cf.    <http://www.dokuwiki.org/config:xsendfile>).  * Added wiki license selection with debconf and postinst.  * debian/config: do not skip wiki title question.  * debian/patches/[many].diff: removed several patches that were applied    upstream:     + debian/patches/cc-by-nd-url.diff     + debian/patches/license_cliopts.diff     + debian/patches/license_jpegmeta.diff     + debian/patches/license-utf8.diff  * debian/patches/posts-are-public-domain-by-default.diff: this patch that    replaced CC-BY-NC-SA with public domain as default license is no longer    needed now the license is selected with debconf.  * debian/patches/soften_email_validator.diff: soften email validator    function, in particular to allow addresses <@localhost>. (Closes: #594732)  * debian/patches/workaround_simplepie.diff: revert to using SimplePie    regular file fetching class, as the DokuWiki custom one is incompatible    with current SimplePie API.  * debian/add-ons/preload.php: allow admin to define its own preload code in    /etc/dokuwiki/preload.php. (Closes: #603628) -- Tanguy Ortolo <email address hidden>  Sun, 21 Nov 2010 16:46:57 +0100

dokuwiki (0.0.20091225c-10) unstable; urgency=low


  * debian/po/ja.po: debconf template translation update
     + Japanese, thanks to Hideki Yamane. (Closes: #599881)
  * debian/control: added another myself to Uploaders, to work around the
    wrong email address in the dak database until it is fixed.

 -- Tanguy Ortolo <email address hidden>  Sat, 30 Oct 2010 19:39:59 +0200

dokuwiki (0.0.20091225c-9) unstable; urgency=low


  * debian/control: added DM-Upload-Allowed.
  * debian/po/*.po: debconf templates translation update
     + French, thanks to Steve Petruzzello. (Closes: #596431)
     + Swedish, thanks to Martin Bagge. (Closes: #597004)
     + Vietnamese, thanks to Clytie Siddall. (Closes: #598349)
     + Italian (new translation), thanks to Vincenzo Campanella.
  * debian/overrides/lintian/dokuwiki: documented lintian overrides.
  * debian/README.Debian: corrected paths to users and ACL files.
    (Closes: #594731)

 -- Tanguy Ortolo <email address hidden>  Tue, 28 Sep 2010 20:33:07 +0200

dokuwiki (0.0.20091225c-8) unstable; urgency=low


  * debian/rules: remove lib/exe/multipleUpload.swf from binary package, as it
    cannot be built from source, violating the Policy. (Closes: #592593)
  * debian/NEWS: document that removal and how to get
    lib/exe/multipleUpload.swf from the upstream distribution.
  * debian/postinst: correct wrong plugin path
     + in the dpkg-statoverride. (Closes: #592653)
     + in the symlink creation. (Closes: #592656)
  * debian/po/de.po: debconf template translation update
     + German, thanks to Holger Wansing. (Closes: #592651)
  * debian/copyright: explicited the license of lib/_fla/* (the Flash-base
    multiple upload applet).

 -- Tanguy Ortolo <email address hidden>  Fri, 13 Aug 2010 22:28:17 +0200

dokuwiki (0.0.20091225c-7) unstable; urgency=low


  * debian/po/fr.po: debconf template translation update
     + French, thanks to Steve Petruzzello. (Closes: #591252)
  * debian/control: bumped Standards-Version to 3.9.1 (no change
    needed).

 -- Tanguy Ortolo <email address hidden>  Mon, 09 Aug 2010 22:20:07 +0200

dokuwiki (0.0.20091225c-6) unstable; urgency=low


  * debian/postinst: check existence of conffiles before chown/chmoding them:
    the user may have deleted them. (Closes: #589263)
  * debian/po/*.po: debconf templates translation update
     + Czech, thanks to Miroslav Kure. (Closes: #589566)
     + Danish (new translation), thanks to Joe Hansen. (Closes: #589095)
     + Spanish, thanks to Francisco Javier Cuadrado. (Closes: #590051)
     + Portuguese, thanks to Rui Branco. (Closes: #589086)
     + Russian, thanks to Yuri Kozlov. (Closes: #588950)

 -- Tanguy Ortolo <email address hidden>  Sun, 25 Jul 2010 23:26:28 +0200

dokuwiki (0.0.20091225c-5) unstable; urgency=low


  * debian/preinst: remove useless ucf association with
    /usr/share/dokuwiki/.htaccess
  * debian/postinst:
     + make /etc/dokuwiki/local.php readable by the web server.
       (Closes: #588699)
     + transition to plugins and templates under /var/lib/dokuwiki/lib,
       see below.
     + remove auto_prepend_file from Apache configuration: it only works
       with mod_php and is now useless, see below.
     + generate wiki configuration file /etc/dokuwiki/local.php candidate
       event if there is already one: ucf is here to allow the user to manage
       the conflict.
  * debian/postrm: do not call lighty-disable-mod if lighttpd is not
    installed. (Closes: #588700)
  * debian/copyright: integrated the BSD license, as it will be removed from
    common-licenses.
  * debian/control: updated Standards-Version to 3.9.0, taking into account
    the BSD license removal from common-licenses.
  * debian/patches/fhs.diff: modified lib/plugins/acl/ajax.php to define
    DOKU_INC to its location under Debian. (Closes: #588405) (LP: #589469)
  * Added an ucf historical md5sum file for
    /usr/share/dokuwiki/.htaccess.dist.
  * conf/license.php: backported an upstream commit to fix the CC-BY-ND
    license URL (btw, this license is inappropriate for a wiki, and will be
    removed in the next upstream version). (Closes: #531353)
  * Added a lintian override for a template detected as unused because
    lintian does not understand Perl config scripts.
  * Moved templates and plugins to /var/lib/dokuwiki/lib, to reproduce the
    original hierarchy of DokuWiki, so that plugins with standalone scripts
    can find it where they expect it. Cf.
    <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=588405#20>.

 -- Tanguy Ortolo <email address hidden>  Sun, 11 Jul 2010 23:13:10 +0200

dokuwiki (0.0.20091225c-4) unstable; urgency=low


  * debian/control:
     + added Vcs-* fields (correct ones, this time).
     + removed useless build-dependency on sharutils.
     + switch from Uploader to Maintainer.
  * Added debconf and postinst support for special file system rights:
    optional web-writeable configuration and plugins. (Closes: #572502)
    (LP: #219414, #205908)
  * Added debconf and postinst support for wiki configuration.
    (Closes: #404353)
  * debian/templates: corrected templates according to advice from
    <debian-l10-en@l.d.o>.
  * debian/config: removed non-translatable titles.
  * debian/preinst: removed useless exit 0.
  * debian/postinst:
     + made the plugins and template transition to /var/lib/ more robust
       for some specific cases.
       (Closes: #572377)
     + corrected web server reload command (file descriptor #3 redirection,
       see bug #446324).
     + write configuration for apache2 only if autoconfiguration for apache2
       is requested.
     + apache2 configuration: added preload.php as an auto_prepend_file
       for the plugins directory, to set the base DokuWiki directory for
       plugins that need to find it.
     + use full path for lighttpd-{enable|disable}-mod.
  * debian/postrm:
     + updated content purging rules with more precise ones.
     + moved #DEBHELPER# placeholder to the end.
     + removed old commented part.
     + use full path for lighttpd-{enable|disable}-mod.
  * debian/rules:
     + updated to debhelper 7 new syntax: implicit catch-all rule and
       dedicated overrides.
     + updated special permissions rules with more precise ones:
        - the web server only needs write permissions to the data and cache
          directories and files.
        - root:www-data is more appropriate for web apps configuration files.
  * Added auto-configuration for the lighttpd server. (LP: #489987)
  * Disabled the built-in update notifier, not relevant for a distro-managed
    software. (LP: #325013)
  * Updated the debian footer button: cleaner Debian spiral, HTML code similar
    to the other buttons.
  * Removed the symlink to /etc/dokuwiki not to expose it to the web.
  * Moved the prepend.php to the new upstream-supported inc/preload.php
    and removed the now useless PHP preload code from the .htaccess.
    Cf. <http://www.dokuwiki.org/security#move_directories_out_of_docroot>.
  * debian/copyright and patches: clarified the licences of files that were
    taken from other projects.

 -- Tanguy Ortolo <email address hidden>  Mon, 21 Jun 2010 23:41:02 +0200

dokuwiki (0.0.20091225c-3) unstable; urgency=low


  * Switch to dpkg-source 3.0 (quilt) format
  * debian/postinst: corrected web server configuration path.

 -- Tanguy Ortolo <email address hidden>  Sun, 28 Feb 2010 11:50:46 +0100

dokuwiki (0.0.20091225c-2) unstable; urgency=low


  [ Tanguy Ortolo ]
  * debconf/templates: new templates to chose webserver to reconfigure
    and to restart.
  * debconf/config: reconfigure and restart the webservers according to  the
    user choice.

  [ Mohammed Adnène Trojette ]
  * Review and upload to unstable.

 -- Mohammed Adnène Trojette <email address hidden>  Sat, 27 Feb 2010 19:16:30 +0100

dokuwiki (0.0.20080505-4+lenny1) stable-security; urgency=high


  * Non-maintainer upload by the Security Team.
  * Fixed CVE-2010-0287, CVE-2010-0288, CVE-2010-0289 (Closes: #565406)

 -- Giuseppe Iuculano <email address hidden>  Fri, 22 Jan 2010 15:57:35 +0100

dokuwiki (0.0.20090214b-3.1) unstable; urgency=high


  * Non-maintainer upload by the Security Team.
  * Check against cross-site request forgeries (CSRF)
  * Fixed multiple vulnerabilities in ACL plugin (Closes: #565406)

 -- Giuseppe Iuculano <email address hidden>  Sun, 17 Jan 2010 14:47:41 +0100

dokuwiki (0.0.20090214b-3) unstable; urgency=low


  * Fix bashism in debian/postinst. (Closes: #515612)

 -- Mohammed Adnène Trojette <email address hidden>  Mon, 13 Jul 2009 11:52:28 +0200

dokuwiki (0.0.20090214b-2) unstable; urgency=low


  * templates:
     + no longer support older versions of Apache.
     + don't purge data by default.
  * control: bump Standards-Version to 3.8.2.

 -- Mohammed Adnène Trojette <email address hidden>  Sat, 27 Jun 2009 17:53:39 +0200

dokuwiki (0.0.20090214-1) unstable; urgency=low


  * New upstream release.
  * No longer ship a php-geshi copy. (Closes: #513869)
  * Don't refer to Creative Common licence but use
    Public Domain by default - licence remains configurable
    of course. (Closes: #513094)
  * No longer remove lib/plugins/config/lang/{eu,tr}
    directories (which are no more empty).

 -- Mohammed Adnène Trojette <email address hidden>  Sat, 14 Feb 2009 19:23:37 +0100

dokuwiki (0.0.20080505-5) unstable; urgency=low


  * Debconf template translation updates:
     + Spanish, thanks to Francisco Javier Cuadrado. (Closes: #508727)
  * Also install VERSION file in /usr/share/dokuwiki. (Closes: #500581)

 -- Mohammed Adnène Trojette <email address hidden>  Wed, 24 Dec 2008 02:43:35 +0100

dokuwiki (0.0.20080505-4) unstable; urgency=high


  * Depend on php-geshi instead of the embedded version (SA32559).
    Thanks to Giuseppe Iuculano for taking care. (Closes: #)

 -- Mohammed Adnène Trojette <email address hidden>  Sat, 08 Nov 2008 14:18:29 +0100

dokuwiki (0.0.20080505-3) unstable; urgency=high


  * High-urgency upload for RC bug fixing.
  * Rewrite postinst in shell thanks to a patch inspired from Dmitry
    Semyonov's:
     + unblock upgrades. (Closes: #481394)
     + don't fail when comparing Debian versions. (Closes: #495360)
  * Remove linda overrides.
  * Remove some lintian errors:
     + remove empty directories.
     + bump Standards-Version to 3.8.0 (no changes needed).
  * README.Debian: document the fact that cleaning the cache directory
    shall help updating the pages on updates. (Closes: #480888)
  * Debconf template translation updates
     + Vietnamese, thanks to Clytie Siddall (Closes: #500022)

 -- Mohammed Adnène Trojette <email address hidden>  Mon, 29 Sep 2008 15:43:05 +0200