# changelog

author: adrian@suse.de
changelog:
  - OBS 2.6.4 release
    Feature backports:
    ==================
    * none
    Changes:
    ========
    * none
    Bugfixes:
    =========
    * webui: fix read access to local files on server
    * api: fix database connection leak caused by sphinx indexing
    * backend: fix blocking ajax handler on getbinaries


author: adrian@suse.de
changelog:
  - OBS 2.6.5 release
    Feature backports:
    ==================
    * none
    Changes:
    ========
    * webui: make the hint to interconnect more visible
    Bugfixes:
    =========
    * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
    * config: fixed apache 2.4 config in template file


author: hvogel@suse.com
changelog:
  - OBS 2.6.6 release
    Feature backports:
    ==================
    * none
    Changes:
    ========
    * Keep enforce_project_keys/forceprojectkeys in sync
    Bugfixes:
    =========
    * webui: fix XSS attack vector via project.title


author: cbruckmayer@suse.com
changelog:
  - OBS 2.6.7 release
    Feature backports:
    ==================
    * none
    Changes:
    ========
    * backend: compability support with Download-on-Demand definitions from OBS 2.7
    Bugfixes:
    =========
    * webui: drop hardcoded opensuse email adress and link
    * webui: fix XSS attack vector via User.realname (bnc#950932)
    * webui: fix XSS attack vector via Projec.title (bnc#950932)
    * webui: add spec & changes files code highlighting


author: adrian@suse.de
changelog:
  - OBS 2.6.8 release
    Feature backports:
    ==================
    * none
    Changes:
    ========
    * none
    Bugfixes:
    =========
    This release fixes several potential CVEs reported in Ruby on Rails
    http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
    * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
    * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
    * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
    * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
    * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
    * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
    * [backend] fix local building inside a project on a remote OBS instance
    * [backend] fix lost events on scheduler restart


author: cbruckmayer@suse.com
changelog:
  - OBS 2.7.1 relase
    Feature backports:
    ==================
    * none
    Changes:
    ========
    * none
    Bugfixes:
    =========
    * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
    * [webui] Users in not 'confirmed' state were allowed to login
    * [api] Users in not 'confirmed' state were allowed to run services via former created token
    * [backend] Fixing project copy which includes binaries
    * [backend] worker supports jobs from OBS 2.8 scheduler
    * [backend] support publishing of .vdi (VirtualBox image) files


author: tizen.build@samsung.com
changelog:
  - OBS 2.7.4 Tizen 20170522 release
    Feature backports:
    ==================
    * none
    Changes:
    ========
    * none
    Bugfixes:
    =========
    * Send reference project name for UPDATE_PROJECT and...
    * Use same configuration variable for notification with...
    * Do not allow editing of inherited packages.
    * Problem when sending rpm stage option to worker
    * Add parameters (sourceproject, targetproject) in REQUES...
    * BUGFIX: retrigger wrong project.
    * remove dependency of BuildMonitor
    * receive relay_notify events.


