Change log for request-tracker3.6 package in Ubuntu

request-tracker3.6 (3.6.5-1ubuntu0.1) hardy-security; urgency=low

  * SECURITY UPDATE: support salted passwords in database and upgrade
    unsalted passwords (CVE-2011-0009)
    - LP: #750339
  * Security fix: only allow SuperUsers to edit global RT at a Glance
  * Security fix: escape custom field values before display to prevent
    XSS attack
  * Security fix for session fixation vulnerability (CVE-2009-3585,
    CVE-2009-4151)
  * Security fix: fix information leakage in scrips (CVE-2011-1008)
  * Multiple security fixes for:
     - Information disclosure via SQL injection (CVE-2011-1686)
     - Information disclosure via search interface (CVE-2011-1687)
     - Information disclosure via directory traversal (CVE-2011-1688)
     - User javascript execution via XSS vulnerability (CVE-2011-1689)
     - Authentication credentials theft (CVE-2011-1690)
     - XSS relating to login credentials
 -- Dominic Hargreaves <email address hidden>   Sun, 29 May 2011 14:38:31 +0100

Available diffs

• diff from 3.6.5-1 (in Ubuntu) to 3.6.5-1ubuntu0.1 (9.7 KiB)

request-tracker3.6 (3.6.8-1) unstable; urgency=low

  * New upstream release
    - Minor security fix (Closes: #532990)
    - other minor bug fixes and translation updates
  * Japanese debconf translation, thanks to Hideki Yamane (Closes: #512855)
  * Switch dependency on sysklogd to rsyslog (Closes: #526913)
  * Update Standards-Version (no changes)
  * Add missing ${misc:Depends} to debian/control (thanks, Lintian)
  * Add Suggests: speedy-cgi-perl to avoid Lintian error

 -- Ubuntu Archive Auto-Sync <email address hidden>   Mon,  15 Jun 2009 11:18:20 +0100

Available diffs

• diff from 3.6.7-5 to 3.6.8-1 (233.8 KiB)

request-tracker3.6 (3.6.7-5) unstable; urgency=high

  * Urgency high due to RC bug-fix
  * Add myself to Uploaders
  * In package description, clarify that RT 3.4 is no longer available
    in Debian
  * Document the fact that SQLite isn't recommended in production
    (Closes: #512750)
  * Swedish debconf translation, thanks to Martin Bagge (Closes: #511246)

 -- Ubuntu Archive Auto-Sync <email address hidden>   Mon,  09 Feb 2009 08:56:54 +0000

Available diffs

• diff from 3.6.7-4 to 3.6.7-5 (5.9 KiB)

request-tracker3.6 (3.6.7-4) unstable; urgency=medium

  * Don't use debconf as a registry for installed database backend
    packages: ignore the debconf settings if the packages are already
    installed. (Closes: #503667)
  * Use the correct server name for self referencing URIs. (Closes: #503329)
  * Urgency set to medium because of an RC bug fix.

Available diffs

• diff from 3.6.7-2 to 3.6.7-4 (1.2 KiB)

request-tracker3.6 (3.6.7-2) unstable; urgency=low

  * Install the default SQLite database under
    /var/lib/dbconfig-common/sqlite3/request-tracker3.6
    instead of /var/cache/request-tracker3.6/ (Closes: #487891)
  * Handle upgrades from broken versions by moving an existing database
    to the right place in the postinst and fixing its permissions
    when needed.

 -- Ubuntu Archive Auto-Sync <email address hidden>   Thu,  26 Jun 2008 09:08:25 +0100

Available diffs

• diff from 3.6.7-1 to 3.6.7-2 (1.4 KiB)

request-tracker3.6 (3.6.7-1) unstable; urgency=low

  * New upstream release.
    + libdbix-searchbuilder-perl dependency bump to (>= 1.53)
    + new dependency on libdevel-stacktrace-perl (>= 1.19)
  * More debconf translations, unfuzzied where needed:
    + Galician, thanks to Jacobo Tarrio. (Closes: #483877)
    + Czech,    thanks to Miroslav Kure. (Closes: #480299)
  * Prefer libmime-tools-perl over its old name, libmime-perl, in the
    dependencies. Thanks, lintian.
  * Add debian/watch.
  * Add Vcs-* fields pointing to the Alioth SVN repository.

 -- Ubuntu Archive Auto-Sync <email address hidden>   Wed,  25 Jun 2008 17:21:58 +0100

Available diffs

• diff from 3.6.6-4 to 3.6.7-1 (268.1 KiB)

request-tracker3.6 (3.6.6-4) unstable; urgency=low

  * More debconf translations, unfuzzied where needed:
    + French,  thanks to Martin Bahier. (Closes: #478114)
    + Russian, thanks to Yuri Kozlov.   (Closes: #477992)
    + Italian, thanks to Luca Monducci. (Closes: #477717)

 -- Ubuntu Archive Auto-Sync <email address hidden>   Fri,  09 May 2008 09:36:11 +0100

request-tracker3.6 (3.6.6-3) unstable; urgency=low

  * Debconf translations:
    + German, thanks to Helge Kreutzmann. (Closes: #475414)
    + Vietnamese, thanks to Clytie Siddall. (Closes: #477327)
  * Don't install empty javascript libraries. (Closes: #475287)
  * Remove an extra whitespace from the master debconf templates
    and unfuzzy existing translations. (Closes: #475415)
  * Depend on dbconfig-common (>= 1.8.38) to pull in various important
    fixes and allow symlinks for the upgrade scripts.
  * Limit mail gateway access to localhost by default in apache2-*.conf.
    Thanks to Arthur de Jong. (Closes: #476269)

request-tracker3.6 (3.6.5-1) unstable; urgency=low

  * New upstream release.

 -- Ubuntu Archive Auto-Sync <email address hidden>   Wed,  24 Oct 2007 07:37:34 +0100

request-tracker3.6 (3.6.1-3~dapper1) dapper-backports; urgency=low

  * Automated backport upload; no source changes.

request-tracker3.6 (3.6.4-1) unstable; urgency=low

  * New upstream release. (Closes: #404913)
    + fixes display of queue names containing ampersands. (Closes: #416702)
    + fixes RFC 2047 header decoding. (Closes: #429560)
    + removes several unused dependencies
    + adds dependencies on libtimedate-perl 
      and libterm-readline-(perl|gnu)-perl
  * Remove support for Apache 1, recently removed from Debian.
    (Closes: #429073)
  * debian/patches/*.dpatch:
    + 06_devel_deps: removed, no longer needed.
    + 20_search_by_requestor: removed, now included upstream.
    + 40_encoding: fix double UTF-8 encoding in the web interface.
      (Closes: #416474)
  * Update SpeedyCGI alternative dependencies. (Closes: #417545)
  * Add an alternative FastCGI dependency on libapache2-mod-fcgid
    to rt3.6-apache2, and include an example Apache2 configuration file.
  * Downgrade libtext-quoted-perl dependency to a recommendation. It's
    now an optional runtime dependency, since it can cause Perl segfaults
    (see #400733). This is also mentioned in NOTES.Debian.
  * Elaborate the comments in all the Apache example configuration files.
  * Add a note about RT_SiteConfig being only readable by root after
    installation.
  * Use the source:Version substitution variables instead of the deprecated
    Source-Version.
  * Upgrade to debhelper compatibility level 5.

 -- Michael Bienia <email address hidden>   Fri,  13 Jul 2007 10:45:53 +0100

request-tracker3.6 (3.6.1-4ubuntu1) gutsy; urgency=low

  * Remove rt3.4-apache since apache 1.3.x is no longer presen into the
    archives (LP: #124501)
  * Update Maintainer field in debian/control

 -- Luca Falavigna <email address hidden>   Sat,  7 Jul 2007 09:43:02 +0200

request-tracker3.6 (3.6.1-4) unstable; urgency=low

  * fix the last reference to INSTALL.Debian. (Closes: #406074)
  * add an alternative dependency on libcgi-fast-perl to rt3.6-apache2.
    (Closes: #408389)
  * add a note about a common MySQL misconfiguration causing repeated
    logins. (Closes: #408405)
  * point to rt3.6-clients instead of rt3-clients for mail configuration. 
    (Closes: #411856)

 -- Ubuntu Archive Auto-Sync <email address hidden>   Fri,  27 Apr 2007 01:20:21 +0100

request-tracker3.6 (3.6.1-3) unstable; urgency=low

  * Fix searching by requestor email address. Patch taken from upstream
    SVN r5782. (Closes: #400655)
  * Add a note in rt3.6-clients README.Debian about debugging deferred
    deliveries. (See #397783)

 -- Ubuntu Archive Auto-Sync <email address hidden>   Wed,  13 Dec 2006 12:46:26 +0000

request-tracker3.6 (3.6.1-2) unstable; urgency=low

  [ Niko Tyni ]
  * Update debian/copyright.
  * Rename INSTALL.Debian to NOTES.Debian to avoid the lintian warning.
  * Add lintian override for permissions of RT_SiteConfig.pm, which has
    a password inside. (See #307633)

  [ Toni Mueller ]
  * completed Lintian override file