<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="1">
<package pkgid="d83e1133819dd1746be2f5224070196fe944dc620e68e94725fb61fd6924076b" name="obs-server" arch="src">
  <version epoch="0" ver="2.7.3" rel="68.1"/>
  <changelog author="adrian@suse.de" date="1441800000">- OBS 2.6.4 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * webui: fix read access to local files on server
  * api: fix database connection leak caused by sphinx indexing
  * backend: fix blocking ajax handler on getbinaries</changelog>
  <changelog author="adrian@suse.de" date="1444392000">- OBS 2.6.5 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * webui: make the hint to interconnect more visible
  Bugfixes:
  =========
  * webui: fix XSS attack vector via comments (bnc#947736 and CVE-2015-5966)
  * config: fixed apache 2.4 config in template file</changelog>
  <changelog author="hvogel@suse.com" date="1444737600">- OBS 2.6.6 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * Keep enforce_project_keys/forceprojectkeys in sync
  Bugfixes:
  =========
  * webui: fix XSS attack vector via project.title</changelog>
  <changelog author="cbruckmayer@suse.com" date="1446811200">- OBS 2.6.7 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * backend: compability support with Download-on-Demand definitions from OBS 2.7
  Bugfixes:
  =========
  * webui: drop hardcoded opensuse email adress and link
  * webui: fix XSS attack vector via User.realname (bnc#950932)
  * webui: fix XSS attack vector via Projec.title (bnc#950932)
  * webui: add spec &amp; changes files code highlighting</changelog>
  <changelog author="adrian@suse.de" date="1454068800">- OBS 2.6.8 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  This release fixes several potential CVEs reported in Ruby on Rails
  http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/
  * [webui] Fixes CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller.
  * [webui] Fixes CVE-2016-0751: Possible Object Leak and Denial of Service attack in Action Pack
  * [webui] Fixes CVE-2015-7577: Nested attributes rejection proc bypass in Active Record.
  * [webui] Fixes CVE-2016-0752: Possible Information Leak Vulnerability in Action View
  * [webui] Fixes CVE-2016-0753: Possible Input Validation Circumvention in Active Model
  * [webui] Fixes CVE-2015-7581: Object leak vulnerability for wildcard controller routes in Action Pack
  * [backend] fix local building inside a project on a remote OBS instance
  * [backend] fix lost events on scheduler restart</changelog>
  <changelog author="adrian@suse.de" date="1460116800">- prepare OBS 2.7.0 beta release</changelog>
  <changelog author="adrian@suse.de" date="1464696000">- OBS 2.7.0 release</changelog>
  <changelog author="cbruckmayer@suse.com" date="1471003200">- OBS 2.7.1 relase
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * [webui][api] Update rails to version 4.2.7.1 to fix CVE-2016-6316 and CVE-2016-6317
  * [webui] Users in not 'confirmed' state were allowed to login
  * [api] Users in not 'confirmed' state were allowed to run services via former created token
  * [backend] Fixing project copy which includes binaries
  * [backend] worker supports jobs from OBS 2.8 scheduler
  * [backend] support publishing of .vdi (VirtualBox image) files</changelog>
  <changelog author="sk7.park@samsung.com" date="1490961600">- OBS 2.7.3 Tizen 20170331 release</changelog>
  <changelog author="tizen.build@samsung.com" date="1495454400">- OBS 2.7.4 Tizen 20170522 release
  Feature backports:
  ==================
  * none
  Changes:
  ========
  * none
  Bugfixes:
  =========
  * Send reference project name for UPDATE_PROJECT and...
  * Use same configuration variable for notification with...
  * Do not allow editing of inherited packages.
  * Problem when sending rpm stage option to worker
  * Add parameters (sourceproject, targetproject) in REQUES...
  * BUGFIX: retrigger wrong project.
  * remove dependency of BuildMonitor
  * receive relay_notify events.</changelog>
</package>
</otherdata>