wordpress (4.9.5+dfsg1-1) unstable; urgency=medium

  * New upstream source, fixes 3 Security issues Closes: #895034
    - CVE-2018-TBA
      Don't treat localhost as same host by default.
    - CVE-2018-TBA
      Use safe redirects when redirecting login page if SSL is forced
    - CVE-2018-TBA
      Make sure version string is correctly escaped for use in
      generator tags
  * Update to standards version 4.1.4
  * Remove get-orig-source in rules and use uscan

 -- Craig Small <csmall@debian.org>  Sun, 08 Apr 2018 08:11:40 +1000

wordpress (4.9.4+dfsg-1) unstable; urgency=medium

  * New upstream release
  * Removed remove_jshint patch as upstream has found a different hinter

 -- Craig Small <csmall@debian.org>  Fri, 09 Feb 2018 21:35:34 +1100

wordpress (4.9.2+dfsg-1) unstable; urgency=high

  * New upstream security release Closes: #887596
    and resolves CVE-2018-5776
  * Update standards version to 4.1.3 - no change

 -- Craig Small <csmall@debian.org>  Sat, 20 Jan 2018 18:02:18 +1100

wordpress (4.9.1+dfsg-1) unstable; urgency=high

  * New upstream release
  * Release 4.9 was never packaged due to licensing problems
  * This release fixes 6 security issues Closes: #883314
    - CVE-2017-17091
      Use a properly generated hash for the newbloguser key instead
      of a determinate substring.
    - CVE-2017-17092
      Remove the ability to upload JavaScript files for users who 
      do not have the unfiltered_html capability
    - CVE-2017-17093
      Add escaping to the language attributes used on html elements
    - CVE-2017-17094
      Ensure the attributes of enclosures are correctly escaped in
      RSS and Atom feeds
  * Updated to standards 4.1.1
  * New linting for Javascript is disabled due to jshint.js licensing
    issues

 -- Craig Small <csmall@debian.org>  Sat, 09 Dec 2017 16:57:09 +1100

wordpress (4.8.3+dfsg-1) unstable; urgency=high

  * New upstream security release Closes: #880528

 -- Craig Small <csmall@debian.org>  Thu, 02 Nov 2017 22:16:15 +1100

wordpress (4.8.2+dfsg-2) unstable; urgency=high

  * Hash user activation key Closes: #877629
    Fixes CVE-2017-14990

 -- Craig Small <csmall@debian.org>  Wed, 04 Oct 2017 21:59:11 +1100

wordpress (4.8.2+dfsg-1) unstable; urgency=high

  * New upstream security release fixes 9 security issues closes: #876274
    - CVE-2017-14723
      $wpdb->prepare() can create unexpected and unsafe queries leading to
      potential SQL injection (SQLi)
    - CVE-2017-14724
      Cross-site scripting (XSS) vulnerability in the oEmbed discovery
    - CVE-2017-14726
      Cross-site scripting (XSS) vulnerability in the visual editor
    - CVE-2017-14719
      Path traversal vulnerability in the file unzipping code
    - CVE-2017-14721
      Cross-site scripting (XSS) vulnerability in the plugin editor
    - CVE-2017-14725
      Open redirect in the user and term edit screens
    - CVE-2017-14722
      Path traversal vulnerability in the customizer
    - CVE-2017-14720
      Cross-site scripting (XSS) vulnerability in template names
    - CVE-2017-14718
      Cross-site scripting (XSS) vulnerability in the link modal

 -- Craig Small <csmall@debian.org>  Fri, 22 Sep 2017 21:57:06 +1000

wordpress (4.8.1+dfsg-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Thu, 03 Aug 2017 21:35:33 +1000

wordpress (4.8+dfsg-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Fri, 09 Jun 2017 22:43:40 +1000

wordpress (4.7.5+dfsg-2) unstable; urgency=medium

  * Don't trust SERVER_NAME variable for emails
    CVE-2017-8295 Closes: #862053

 -- Craig Small <csmall@debian.org>  Mon, 05 Jun 2017 21:45:59 +1000

# For older changelog entries, run 'apt-get changelog wordpress-theme-twentyfifteen'
