redmine (3.2.1-2ubuntu0.2) xenial-security; urgency=medium

  * SECURITY UPDATE: persistent XSS exists due to textile formatting
    - debian/patches/0020-Fix-CVE-2019-17427.patch: improve the way
      that html tags are identified to be escaped. (LP: #1853063)
    - CVE-2019-17427
    - https://www.cvedetails.com/cve/CVE-2019-17427/
    - Redmine Defect #31520
  * SECURITY UPDATE: SQL injection vulnerability
    - debian/patches/0021-Fix-CVE-2019-18890.patch: use map instead of each
      because it casts the values to integer and return a new array.
      (LP: #1853063)
    - CVE-2019-18890
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18890
    - Redmine Defect #32374

 -- Lucas Kanashiro <lucas.kanashiro@canonical.com>  Mon, 18 Nov 2019 18:15:09 -0300

redmine (3.2.1-2) unstable; urgency=medium

  [ Jonatan Nyberg ]
  * Swedish translation update (Closes: #819743)

  [ Antonio Terceiro ]
  * 0004-Add-multi-tenancy-support.patch: load dependencies for all database
    drivers used by all Redmine instances (Closes: #819815)
  * 0005-Assume-default-instance.patch: remove change to Gemfile, not needed
    anymore.

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 03 Apr 2016 20:24:31 -0300

redmine (3.2.1-1) unstable; urgency=medium

  [ Antonio Terceiro ]
  * New upstream release
  * Refresh patches
  * Change dependency from bundler to ruby-bundler, so that just installing
    redmine doesn't get you a toolchain (Closes: #816075)

  [ Américo Monteiro ]
  * Updated Portuguese translation
    (Closes: #816140)

  [ Julien Patriarca ]
  * Updated French debconf translation
    (Closes: #816681)

  [ Takuma Yamada ]
  * Japanese debconf templates translation update
    (Closes: #817864)

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 20 Mar 2016 13:54:44 -0300

redmine (3.2.0-3) unstable; urgency=medium

  * 0001-Gemfile-relax-some-dependencies.patch: also relax dependency on
    mysql2
  * debian/control: bump Standards-Version to 3.9.7; no changes needed.

 -- Antonio Terceiro <terceiro@debian.org>  Thu, 25 Feb 2016 20:23:14 -0300

redmine (3.2.0-2) unstable; urgency=medium

  * Enforce dependencies on the required versions of rails and jquery-rails
    (Closes: #814833)

 -- Antonio Terceiro <terceiro@debian.org>  Tue, 16 Feb 2016 10:26:50 -0200

redmine (3.2.0-1) unstable; urgency=medium

  * New upstream release
    - new dependencies: ruby-rbpdf, ruby-roadie-rails
  * debian/watch: point at github
  * Bump debhelper compatibility level to 9
  * Move from cdbs to dh
  * Stop builing fonts, upstream redmine doesn't rely on them anymore
  * Dropped all patches already applied upstream and reworked all others.
    Remaining patches:
    - 0001-Gemfile-relax-some-dependencies.patch: adapt Gemfile
      - now working against dependencies in unstable
        (Closes: #808466, #792870)
    - 0002-Force-table-encoding-in-mysql.patch
    - 0003-Use-production-environment-by-default.patch
    - 0004-Add-multi-tenancy-support.patch
  * debian/copyright: updated wrt recent changes in the upstream tree
  * debian/control: remove Conflicts: against packages that don't exist in
    jessie.
  * dropped obsolete dependency on libjs-scriptaculous
  * Recommends: change ruby-passenger to passenger, drop old libfcgi-ruby*
  * Suggests: add ruby-fcgi
  * debian/control: move myself to Maintainer:, and move Jérémy Lal
    to Uploaders:
  * List runtime dependencies as build dependencies as well, and check that
    all dependencies are OK at build time.
  * Switch Vcs-* to https URLs

 -- Antonio Terceiro <terceiro@debian.org>  Mon, 15 Feb 2016 09:20:02 -0200

redmine (3.0~20140825-8) unstable; urgency=medium

  * Replace "interest" triggers with "interest-nowait" ones to avoid trigger
    loops (Closes: #786763)

 -- Antonio Terceiro <terceiro@debian.org>  Fri, 10 Jul 2015 20:07:20 -0300

redmine (3.0~20140825-7) unstable; urgency=medium

  * debian/postinst: always remove and recreate Gemfile.lock to handle the
    case where dependencies are being upgraded.

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 03 May 2015 19:18:34 -0300

redmine (3.0~20140825-6) unstable; urgency=medium

  * debian/doc/examples/apache2-host.conf: fix typo in package name user is
    told to install Closes: #777736
  * Fix upgrades when there are locally-installed plugins Closes: #779273
    - debian/postinst: run rake under `bundle exec` to correctly handle
      upgrades when the local admin installed non-packaged plugins (i.e.
      ~100% of them).
    - 2003_externalize_session_config.patch, 2002_FHS_through_env_vars.patch,
      gemfile-adjustments.patch: always set RAILS_ETC, RAILS_* unconditionally
      from X_DEBIAN_SITEID because the load order under `bundle exec` seems to
      be a little different.
    - change Gemfile.lock handling:
      + symlink Gemfile.lock to /var/lib/redmine/Gemfile.lock
      + always update it at the beginning of debian/postinst
      + trigger postinst Ruby packages are upgraded
  * Don't leave unowned files after purge. Closes: #781534
    - debian/postinst:
      - don't create files under /usr/share/redmine/app
      - pass SCHEMA=/dev/null to rake `db:migrate` so it won't create
        /usr/share/redmine/db/schema.rb
    - debian/postrm: remove the aforementioned files
  * debian/postinst: fix several programming errors
    - initialize variable that will hold the return code of a potentially
      failing command to 0 so it is not undefined if the command suceeeds.
      Closes: #780894
    - add missing quotes around $fHasOldSessionName
    - fix logic when testing whether session.yml file exists
    - restrict usage of $2 as a version number when triggered, since $2 will
      contain the trigger names instead.
  * debian/patches/fix-move-issue-between-projects.patch: applied patch by
    Tristam Fenton-May to fix moving issues across projects (Closes: #783717)
  * debian/install:
    - install bin/ directory so rails detects redmine as a proper Rails app
      + This fixes running `rails console`, `rails dbconsole` etc from within
        the installed package at /usr/share/redmine.
    - don't install deprecated script/ directory
  * debian/doc/examples/apache2-passenger-*.conf: document line that must
    be changed in extra instances.
  * debian/patches/gemfile-adjustments.patch:
    - bump dependency on redcarpet
    - don't try to read database.yml is it's not readable

 -- Antonio Terceiro <terceiro@debian.org>  Sat, 02 May 2015 11:33:20 -0300

redmine (3.0~20140825-5) unstable; urgency=high

  * debian/patches/0001-Escape-flash-messages-19117.patch
    - Fix potential XSS vulnerability with flash messages.
    - No CVE id assigned yet

 -- Antonio Terceiro <terceiro@debian.org>  Sun, 22 Feb 2015 11:32:27 -0300

# For older changelog entries, run 'apt-get changelog redmine-mysql'
