cacti (1.2.30+ds1-1ubuntu2) resolute; urgency=medium

  * d/p/php85-support.patch: add support for php8.5

 -- Athos Ribeiro <athos@ubuntu.com>  Mon, 26 Jan 2026 11:26:55 -0300

cacti (1.2.30+ds1-1ubuntu1) questing; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - Fix malformed SQL file autopkgtest error with MySQL 8.4.

 -- Rik Mills <rikmills@kde.org>  Thu, 22 May 2025 09:16:21 +0100

cacti (1.2.30+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.30+ds1 which fixes CVE-2025-26520
    (Closes: #1095721)
  * Drop patches taken from upstream
  * Add Catalan translation for debconf templates

 -- Paul Gevers <elbrus@debian.org>  Sat, 05 Apr 2025 11:12:16 +0200

cacti (1.2.28+ds1-4ubuntu1) plucky; urgency=medium

  * Merge with Debian Unstable. Remaining changes:
    - Fix malformed SQL file autopkgtest error with MySQL 8.4.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Wed, 19 Feb 2025 19:43:46 -0600

cacti (1.2.28+ds1-4) unstable; urgency=medium

  * Add Romanian translation for debconf templates (Closes: #1038924)
  * Adapt and apply 0001-QA-1.2.29-Security-Updates-6074.patch
    CVE-2024-45598 CVE-2024-54145 CVE-2024-54146 CVE-2025-22604
    CVE-2025-24367 CVE-2025-24368
    (Closes: #1094574)

 -- Paul Gevers <elbrus@debian.org>  Wed, 29 Jan 2025 21:01:27 +0100

cacti (1.2.28+ds1-3ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Fix malformed SQL file autopkgtest error with MySQL 8.4

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 27 Jan 2025 10:53:53 -0300

cacti (1.2.28+ds1-3) unstable; urgency=medium

  * gbp.conf: fix to hopefully enable salsa-ci
  * salsa-ci.yml: add again now maybe gbp.conf is fixed
  * tests: don't store all the pages, that's huge
  * E_STRICT got deprecated in php8.4 poluting the log (Closes: #1089723)

 -- Paul Gevers <elbrus@debian.org>  Thu, 12 Dec 2024 14:36:15 +0100

cacti (1.2.28+ds1-2ubuntu1) plucky; urgency=medium

  * Fix malformed SQL file autopkgtest error with MySQL 8.4.

 -- Simon Quigley <tsimonq2@ubuntu.com>  Sun, 08 Dec 2024 20:01:02 -0600

cacti (1.2.28+ds1-2) unstable; urgency=medium

  * tests: don't save access.log, it's so big artifacts aren't available
  * tests: update filter for new output

 -- Paul Gevers <elbrus@debian.org>  Sat, 12 Oct 2024 09:43:21 +0100

cacti (1.2.28+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.28+ds1
  * d/patches: refresh

 -- Paul Gevers <elbrus@debian.org>  Wed, 09 Oct 2024 14:12:37 +0200

cacti (1.2.27+ds1-2) unstable; urgency=medium

  * tests: update expected log messages

 -- Paul Gevers <elbrus@debian.org>  Fri, 17 May 2024 20:45:35 +0200

cacti (1.2.27+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.27+ds1
    Fixes the following vulnerabilities: CVE-2024-27082, CVE-2024-29894,
    CVE-2024-31443, CVE-2024-31444, CVE-2024-31445, CVE-2024-31458,
    CVE-2024-31459, CVE-2024-31460 and CVE-2024-34340
  * Bump copyright years

 -- Paul Gevers <elbrus@debian.org>  Thu, 16 May 2024 19:39:10 +0200

cacti (1.2.26+ds1-1) unstable; urgency=medium

  * postinst/postrm: ensure DEBHELPER content is always run
  * New upstream version 1.2.26+ds1
    Fixes the following vulnerabilities: CVE-2023-49084, CVE-2023-49085,
    CVE-2023-49086, CVE-2023-49088 CVE-2023-46490, CVE-2023-51448 and
    CVE-2023-50250 (Closes: #1059254, #1059286)
  * font-awesom-path.patch: refresh
  * Depends on node-dompurify and link purify.js instead of using upstream
    vendored version

 -- Paul Gevers <elbrus@debian.org>  Sun, 24 Dec 2023 21:46:33 +0100

cacti (1.2.25+ds1-2) unstable; urgency=medium

  * change upstream CHANGELOG logic to accommodate Ubuntu FTBFS
  * Update Vcs to point at Debian namespace to invite others

 -- Paul Gevers <elbrus@debian.org>  Thu, 21 Sep 2023 12:56:55 +0200

cacti (1.2.25+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.25+ds1
    Fixes the following vulnerabilities: CVE-2023-39516,
    CVE-2023-39515, CVE-2023-39514, CVE-2023-39513, CVE-2023-39512,
    CVE-2023-39510, CVE-2023-39366, CVE-2023-39365, CVE-2023-39364,
    CVE-2023-39362, CVE-2023-39361, CVE-2023-39360, CVE-2023-39359,
    CVE-2023-39358, CVE-2023-39357 and CVE-2023-30534
  * Refresh patches

 -- Paul Gevers <elbrus@debian.org>  Wed, 06 Sep 2023 20:58:14 +0200

cacti (1.2.24+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.24+ds1
  * Refresh patches

 -- Paul Gevers <elbrus@debian.org>  Wed, 01 Mar 2023 22:06:58 +0100

cacti (1.2.23+ds1-2) unstable; urgency=medium

  * d/rules: fix for new 'file' behavior (Closes: #1028764)
  * Adapt for changes in php-phpmyadmin-motranslator (Closes: #1028141)
  * d/rules: don't compress CHANGELOG symlink
  * tests: several improvement + re-add my own old check-all-pages

 -- Paul Gevers <elbrus@debian.org>  Thu, 19 Jan 2023 10:30:29 +0100

cacti (1.2.23+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.23+ds1
  * Refresh patches + drop patches from upstream
  * Install all templates during first install instead of only the ones
    from 2017
  * Fix upstream issue #5127: importing templates fails
  * Adapt check_all_pages testing to upstream changes by simplifying
    Debian changes
  * Fix ui-state-default color in classical theme (Closes: #972947)
  * Drop apache2.2 support (only in oldoldoldstable by now)
  * Drop debian/NEWS as it's old
  * Update and add several lintian overrides
  * Don't load external images in documentation to prevent privacy breach:
    remove-external-images.patch

 -- Paul Gevers <elbrus@debian.org>  Thu, 05 Jan 2023 10:25:44 +0100

cacti (1.2.22+ds1-3) unstable; urgency=medium

  [ Athos Ribeiro ]
  * Update installing guides for NO_AUTO_CREATE_USER

  [ Paul Gevers ]
  * Add 7f0e16312dd5ce20f93744ef8b9c3b0f1ece2216.patch to fix
    CVE-2022-46169 (Closes: #1025648)
  * Update debian.php.dist for the fix above to incorporate the
    configuration changes in the package defaults

 -- Paul Gevers <elbrus@debian.org>  Tue, 06 Dec 2022 22:16:33 +0100

cacti (1.2.22+ds1-2) unstable; urgency=medium

  [ Debian Janitor ]
  * Remove constraints unnecessary since buster (oldstable)
  * Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.
  * Update standards version to 4.6.1, no changes needed.
  * Remove empty maintainer scripts: cacti (preinst)

  [ Paul Gevers ]
  * Add 31bfd4b5c1d33af02911441111a430597b9f1021.patch to fix php8.2
    deprecation warnings (Closes: #1022229)

 -- Paul Gevers <elbrus@debian.org>  Wed, 02 Nov 2022 21:24:38 +0100

cacti (1.2.22+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.22+ds1
  * Update 07_cli-include-path.patch

 -- Paul Gevers <elbrus@debian.org>  Tue, 06 Sep 2022 21:53:38 +0200

cacti (1.2.21+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.21+ds1
  * Refresh and update old patch stack
  * Replace dependency on libjs-d3 by node-d3 (Closes: #913385)
  * README.Debian: reorder paragraphs (Closes: #979176)

 -- Paul Gevers <elbrus@debian.org>  Thu, 14 Jul 2022 17:05:21 +0200

cacti (1.2.20+ds1-2) unstable; urgency=medium

  * Revert "Replace dependency on libjs-d3 by node-d3" (Opens: #913385)
    node-d3 isn't ready to replace libjs-d3 as it's not available on armel
    (bugs filed)

 -- Paul Gevers <elbrus@debian.org>  Fri, 22 Apr 2022 20:45:58 +0200

cacti (1.2.20+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.20+ds1
    CVE-2022-0730: Under certain ldap conditions, Cacti authentication can
    be bypassed with certain credential types. (Closes: #1008693)
  * d/copyright: update
  * strip away and replace some of the new midwinter theme like we do for
    other themes
  * Refresh patches and drop those that are part of 1.2.20
  * cacti.links: drop dejavu links as cacti now finds system fonts by
    itself
  * Replace dependency on libjs-d3 by node-d3 (Closes: #913385)
  * Replace broken package (Upstream bug: #4685)
  * Fix multiple issues with new cli scripts (detected by test suite
    failure)

 -- Paul Gevers <elbrus@debian.org>  Thu, 14 Apr 2022 10:16:39 +0200

cacti (1.2.19+ds1-2) unstable; urgency=medium

  * Support cacti on PHP8.1 by incorporating upstream patches
  * Support the use of a csrf secret key out of the box

 -- Paul Gevers <elbrus@debian.org>  Sun, 19 Dec 2021 22:03:28 +0100

cacti (1.2.19+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.19+ds1
    - billboard.js replaces c3.*
    - Drop obsolete patches
    - Update 07_cli-include-path.patch to cover new cli
  * watch: update to scan github as the downloads page doesn't work
    anymore
  * Building documentation in .github fails, don't do that as it's not
    needed anyways
  * [tests] use upstreams version of check_all_pages, but adapted
  * [tests] run upstream check_cli_version.sh test

 -- Paul Gevers <elbrus@debian.org>  Mon, 22 Nov 2021 20:30:48 +0100

cacti (1.2.16+ds1-2) unstable; urgency=medium

  * Add 0001-Fixing-Issue-4022.patch (Closes: #979998)
    - CVE-2020-35701: SQL injection via data_debug.php
  * Add 0001-Fixing-Issue-4019.patch
    There are a few places in the current code where an attacker, once
    having gained access to the Cacti database through a SQL injection,
    could modify data in tables to possibly expose an stored XSS bug in
    Cacti.

 -- Paul Gevers <elbrus@debian.org>  Sun, 17 Jan 2021 21:26:01 +0100

cacti (1.2.16+ds1-1) unstable; urgency=medium

  * New upstream release 1.2.16

 -- Paul Gevers <elbrus@debian.org>  Fri, 11 Dec 2020 21:54:47 +0100

cacti (1.2.15+ds1-2) unstable; urgency=medium

  * Add upstream patch to fix autopkgtest failure:
    643766b909d0824b08c2ab6c7a82ac0055a5d730.patch

 -- Paul Gevers <elbrus@debian.org>  Fri, 06 Nov 2020 20:32:36 +0100

cacti (1.2.15+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.15
  * Update font-awesome-path.patch

 -- Paul Gevers <elbrus@debian.org>  Tue, 03 Nov 2020 21:57:12 +0100

cacti (1.2.14+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.14

 -- Paul Gevers <elbrus@debian.org>  Thu, 27 Aug 2020 10:55:38 +0200

cacti (1.2.13+ds1-2) unstable; urgency=medium

  * Enable upstream CHANGELOG to be viewed

 -- Paul Gevers <elbrus@debian.org>  Fri, 31 Jul 2020 21:31:50 +0200

cacti (1.2.13+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.13
    - refresh 07_cli-include-path.patch

 -- Paul Gevers <elbrus@debian.org>  Mon, 27 Jul 2020 21:39:25 +0200

cacti (1.2.12+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.12
  * Bump libphp-phpmailer dependency
  * Update debian.php.dist to match updated include/config.php

 -- Paul Gevers <elbrus@debian.org>  Thu, 07 May 2020 22:09:43 +0200

cacti (1.2.11+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.11
    - Refresh patch
  * Update debian.php.dist to match updated include/config.php

 -- Paul Gevers <elbrus@debian.org>  Tue, 07 Apr 2020 22:22:16 +0200

cacti (1.2.10+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.10
    CVE-2020-8813 graph_realtime.php allows remote attackers to execute
    arbitrary OS commands via shell metacharacters in a cookie, if a guest
    user has the graph real-time privilege (Closes: 951832)

 -- Paul Gevers <elbrus@debian.org>  Sun, 08 Mar 2020 21:26:46 +0100

cacti (1.2.9+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.9+ds1
    CVE-2020-7106 Remote Code Execution (by privileged users) via shell
    metacharacters in the Performance Boost Debug Log field of
    poller_automation.php. (Closes: #949996)
    CVE-2020-7237 Stored XSS in data_sources.php,
    color_templates_item.php, graphs.php, graph_items.php,
    lib/api_automation.php, user_admin.php, and user_group_admin.php, as
    demonstrated by the description parameter in data_sources.php (Closes:
    #949997)

 -- Paul Gevers <elbrus@debian.org>  Thu, 13 Feb 2020 20:38:01 +0100

cacti (1.2.8+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.8+ds1
    CVE-2019-17357 When viewing graphs, some input variables are not
    properly checked (SQL injection possible) (Closes: #947374)
    CVE-2019-17358 When deserializating data, ensure basic sanitization
    has been performed (Closes: #947375)

 -- Paul Gevers <elbrus@debian.org>  Sat, 28 Dec 2019 17:44:58 +0100

cacti (1.2.7+ds1-1) unstable; urgency=medium

  * New upstream version 1.2.7+ds1
    CVE-2019-16723 Security issue allows to view all graphs (Closes:
    #941036)
  * Refresh and drop patches to match upstream

 -- Paul Gevers <elbrus@debian.org>  Sun, 06 Oct 2019 22:10:41 +0200

cacti (1.2.6+ds1-3) unstable; urgency=medium

  * Add 0001-Resolving-Issue-2984.patch to fix CI error

 -- Paul Gevers <elbrus@debian.org>  Sat, 28 Sep 2019 10:49:29 +0200

cacti (1.2.6+ds1-2) unstable; urgency=medium

  [ Paul Gevers]
  * Fix autopkgtest regression with 0001-Resolving-Issue-2899.patch from
    upstream
  * Apache skipped the php section in apache.conf since PHP 7 (Closes:
    #934898)
  * Translations were broken since 1.2.4+ds1-1. Import upstream solution
    enabling the use of php-phpmyadmin-motranslator.

  [ Rafael David Tinoco ]
  * Prepare sql commands for MySQL 8 (See: #933683)

 -- Paul Gevers <elbrus@debian.org>  Tue, 17 Sep 2019 20:31:04 +0200

cacti (1.2.6+ds1-1) unstable; urgency=medium

  * New upstream release 1.2.6
    - Refresh 07_cli-include-path.patch
  * Remove obsolete link to phpgettext

 -- Paul Gevers <elbrus@debian.org>  Thu, 05 Sep 2019 17:47:08 +0200

cacti (1.2.4+ds1-2) unstable; urgency=medium

  * tests: add new IMPORT messages to ignore filter

 -- Paul Gevers <elbrus@debian.org>  Mon, 15 Jul 2019 19:33:58 +0200

cacti (1.2.4+ds1-1) unstable; urgency=medium

  * New upstream release 1.2.4
    - Fixed upgrade script (Closes: #931702)
    - Fixed snmp gauges (Closes: #930254)
  * Depends i.s.o. Recommends on php-gmp (Closes: #930252)
  * Drop dependency on php-php-gettext as it is optional for cacti and it's
    going to be removed due to CVE-2016-6175
  * Refresh patches
  * Update d/debian.php.dist with changes in include/config.php

 -- Paul Gevers <elbrus@debian.org>  Sun, 14 Jul 2019 21:33:08 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog cacti`.
