Sicherheit: Mehrere Probleme in python-djblets - Pro-Linux

Name        : python-djblets
Product     : Fedora 19
Version     : 0.7.16
Release     : 1.fc19
URL         : http://www.review-board.org
Summary     : A collection of useful classes and functions for Django
Description :
A collection of useful classes and functions for Django

-------------------------------------------------------------------------------
-
Update Information:

As with all ReviewBoard updates, you will need to run 'rb-site upgrade
 /path/to/site' for all installed sites after applying this update.

== Action Required ==

The default Apache configuration is now more strict with how it serves up file attachments. This does not apply to existing installations. See 110173-securing-file-attachmentsfor details.

== Description ==

- New upstream release 1.7.12

- http://www.reviewboard.org/docs/releasenotes/reviewboard/1.7.12/

- Security Fixes:

    * Function names in diff headers are no longer rendered as HTML.

    * If a user’s full name contained HTML, the Submitters list would render it
 as HTML, without escaping it. This was an XSS vulnerability.

    * The default Apache configuration is now more strict with how it serves up file attachments. This does not apply to existing installations. See 110173-securing-file-attachmentsfor details.

    * Uploaded files are now renamed to include a hash, preventing users from
 uploading malicious filenames, and making filenames unguessable.

    * Recaptcha support has been updated to use the new URLs provided by
 Google.

- New Features:

    * Added a X-ReviewRequest-Repository header for e-mails.

- Extension Improvements:

    * Extensions can now specify their list of app directories.

    * Extensions can now specify the author’s URL.

    * Improved the look and feel for extension configuration.

    * Improved the functionality for extension configuration.

    * Improved the list of available extensions.

- Bug Fixes:

    * Fixed the “Show Whitespace Changes” toggle.

    * Fixed compatibility with modern versions of django-storages.

    * Draft comments on file attachments are no longer shown to all users.

    * Fixed issues with console windows appearing when invoking Clear Case
 requests on Python 2.7.x and Windows 7.

    * Review requests on Local Sites are now guaranteed to have the proper ID.

    * Fixed starring review requests on Local Sites.
-------------------------------------------------------------------------------
-
ChangeLog:

* Mon Jul 29 2013 Stephen Gallagher <sgallagh@redhat.com> - 0.7.16-1
- New upstream release 0.7.16
- This release contains security fixes in the datagrid
- JavaScript:
    * autoSizeTextArea now cleans up its hidden proxy elements when destroyed.
    * inlineEditor can be told not to focus a textarea by default by setting
      'focusOnOpen' to false.
    * modalBox can place itself in an element other than <body> by
 setting the
      'container' option to the element.
    * modalBox takes a 'boxID' option that, if specified, will set the
 ID of
      the modalBox element.
    * funcQueue now takes an optional context parameter for callback functions.
- djblets.datagrid:
    * Data pulled from the database and rendered into cells are always escaped
      now.
    * Columns can now specify an image_class instead of an image_url.
    * Added a JavaScript reload() function that can be called on a datagrid
      element to trigger a dynamic reload from the server.
- djblets.extensions:
    * Extensions can now specify their list of app directories.
    * Extensions can now specify the author's URL.
    * Improved the look and feel for extension configuration.
    * Improved the functionality for extension configuration.
    * Improved the list of available extensions.
-------------------------------------------------------------------------------
-

This update can be installed with the "yum" update program.  Use 
su -c 'yum update python-djblets' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce