wordpress (5.3.2+dfsg1-1ubuntu1) focal; urgency=medium

  * Fix compatibility with MySQL 8.0 (LP: #1852775)
    - debian/setup-mysql: create the user before granting privileges, and
      use mysql_native_password authentication.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 27 Jan 2020 11:51:19 -0500

wordpress (5.3.2+dfsg1-1) unstable; urgency=high

  * Fixes some important but non-security bugs.
  * Thanks to Nils Radtke <debbug@think-future.com> for
    their assistance.
  * Version 5.3.1 is a security release, fixes several
    issues Closes: #946905
    - an unprivileged user could make a post sticky via the REST API.
    - cross-site scripting (XSS) could be stored in well-crafted links
    - hardening wp_kses_bad_protocol() to ensure that it is aware
      of the named colon attribute.
    - stored XSS vulnerability using block editor content.
  * Fix error in CVE-2017-14990 patch where sub-sites cannot
    authenticate users. Thanks Connor for your help!

 -- Craig Small <csmall@debian.org>  Fri, 27 Dec 2019 15:18:07 +1100

wordpress (5.2.4+dfsg1-1) unstable; urgency=high

  * Security release, fixes several issues Closes: #942459
    - Stored XSS in the Customizer
    - Viewing unauthenticated posts
    - Stored XSS to inject ajavascript into style tags
    - Poisoning JSON GET requests
    - SSRF in URL vaidation
    - Referer validation in admin screens

 -- Craig Small <csmall@debian.org>  Thu, 17 Oct 2019 21:32:54 +1100

wordpress (5.2.3+dfsg1-1) unstable; urgency=medium

  * Security release, fixes several issues Closes: #939543
    - CVE-2019-16223
      XSS in post previews
    - CVE-2019-16218
      XSS in stored comments
    - CVE-2019-16220
      Open redirect due to validation and sanitization
    - CVE-2019-16217
      XSS in media uploads 
    - CVE-2019-16219
      XSS in shortcode previews
    - CVE-2019-16221
      Reflected XSS in dashboard
    - CVE-2019-16222 
      XSS in URL sanitization
  * Use replace for dh-linktrees for underscore-js

 -- Craig Small <csmall@debian.org>  Fri, 06 Sep 2019 18:39:10 +1000

wordpress (5.2.2+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Tue, 25 Jun 2019 21:03:42 +1000

wordpress (5.2.1+dfsg1-1) unstable; urgency=medium

  *  New upstream release

 -- Craig Small <csmall@debian.org>  Sun, 26 May 2019 16:42:33 +1000

wordpress (5.1.1+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Fixes XSS security hole in comments CVE-2019-9787 Closes: #924546
  * Added new/better config example

 -- Craig Small <csmall@debian.org>  Thu, 14 Mar 2019 22:10:00 +1100

wordpress (5.0.3+dfsg1-1) unstable; urgency=medium

  * New upstream release
  * Update to Debian standards 4.3.0

 -- Craig Small <csmall@debian.org>  Tue, 05 Feb 2019 22:23:39 +1100

wordpress (5.0.2+dfsg1-1) unstable; urgency=medium

  * New upstream release

 -- Craig Small <csmall@debian.org>  Fri, 28 Dec 2018 16:00:13 +1100

wordpress (5.0.1+dfsg1-1) unstable; urgency=high

  * New upstream source. fixes 7 Security issues Closes: #916403
    - CVE-2018-20147
      Delete files through altered meta data
    - CVE-2018-20152
      Create posts of unauthorized post types
    - CVE-2018-20148
      PHP object injection through crafted meta data
    - CVE-2018-20153
      Edit other users comments, leading to XSS
    - CVE-2018-20150
      XSS in plugins through crafted URL inputs
    - CVE-2018-20151
      User activation screen visible to search engines
    - CVE-2018-20149
      Bypass MIME verification causing XSS
  * Themes: Remove twentyfifteen, add twentynineteen and make default
  * Remove remote emojis

 -- Craig Small <csmall@debian.org>  Sun, 16 Dec 2018 10:45:32 +1100

# For older changelog entries, run 'apt-get changelog wordpress'
