bugzilla (2.16.7-7sarge2) stable-security; urgency=high

  * Non-maintainer uplaod by the security team

  [Alexis Sukrieh]
  * ./syncshadowdb - CVE-2005-4534
      + Backported patch from 2.16.11 for closing a security issue about temp
        files handling.
      + Upstream security advisory:
        http://www.bugzilla.org/security/2.16.10-nr/

  [Neil McGovern]
  * CVE-2006-5453 fixes
    Thanks to Ben Hutchings for patches
    
 -- Neil McGovern <neilm@debian.org>  Wed,  8 Nov 2006 13:43:13 +0000

bugzilla (2.16.7-7sarge1) testing-proposed-updates; urgency=low

  * Applied upstream security patch (backport from the upstream 2.16.10
    release) for closing CAN-2005-1564 and CAN-2005-1563 (bugzilla's
    bugs #287109, #294655)
    (closes: #308787)

 -- Alexis Sukrieh <sukria@sukria.net>  Tue, 24 May 2005 10:52:30 +0200

bugzilla (2.16.7-6) unstable; urgency=low

  * Added a "checkpo" target in debian/rules for checking the debian/po files.
  * Removed a fuzzy string in fr.po (Christian Perrier).
  * New nl.po file for Debconf l10n (Luk Claes).
    (closes: #302911)
  * New pt_BR.po file for Debconf l10n (Andre Luis Lopes)

 -- Alexis Sukrieh <sukria@sukria.net>  Tue, 12 Apr 2005 17:33:23 +0200

bugzilla (2.16.7-5) unstable; urgency=low

  * Rewrote Debconf templates for DTSG compliance (Christian Perrier).
      - New fr.po file for Debconf l10n (Christian Perrier).
      - New cs.po file for Debconf l10n (Jan Outrata).
      - New pt_BR.po file for Debconf l10n (Andre Luis Lopes).
      - New de.po file for Debconf l10n (Jens Nachtigall).
      - New ca.po file for Debconf l10n (Miguel Gea Milvaques).
    (closes: #294433, #294159, #294234)
  * showdependencygraph.cgi
    + Changed the $var_dir value in showdependencygraph.cgi to
      /usr/share/bugzilla/web.
    + Fixed a bug when generating the url path of the /data/webdot/*.dot.map files.
    (closes: #300857)

 -- Alexis Sukrieh <sukria@sukria.net>  Tue, 22 Mar 2005 14:35:15 +0100

bugzilla (2.16.7-4) unstable; urgency=low

  * Fixed the link in PutHeader() in editusers.cgi.
    (closes: #228140)
  * The sidebar is now fixed, the search field works (thanks to 
    Maximiliano Pin).
    (closes: #271790)
  * Fixed postinst, upgrade of MySQL tables is now possible.
    (closes: #293135)

 -- Alexis Sukrieh <sukria@sukria.net>  Tue,  1 Feb 2005 13:49:22 +0100

bugzilla (2.16.7-3) unstable; urgency=low

  * Fixed a bugzilla.config bug, admin password won't be prompted twice in
    Automatic mode.
  * Added Czech translation for Debconf messages (Jan Outrata).
    (closes: #291575)
  * Updated French Debconf translation in debian/po/fr.po (Christian Perrier).
    (closes: #285978, closes: #189402)
  * Updated debian/po/ja.po to fix fuzzy and untranslated lines (Hideki
    Yamane).
    (closes: #286029)
  * Added Catalan Debconf translation in debian/po/ca.po (Miguel Gea
    Milvaques).
    (closes: #284150)
  * Updated Dutch Debconf translation in debian/po/nl.po (Luk Claes).
    (closes: #285747)
  * Updated German Debconf translation in debian/po/de.po (Jens Nachtigall).
    (closes: #275669)

 -- Alexis Sukrieh <sukria@sukria.net>  Thu, 27 Jan 2005 12:34:58 +0100

bugzilla (2.16.7-2) unstable; urgency=low

  * Applying upstream security patch for closing XSS issuses reported in
    CAN-2004-1061.
    (closes: #288245)
  * Little bugfix in postinst, admin password was prompted twice.
  * Updated README.Debian to explain how the bugzilla MySQL user is generated
    in automatic installation mode.

 -- Alexis Sukrieh <sukria@sukria.net>  Sat,  8 Jan 2005 12:42:25 +0100

bugzilla (2.16.7-1) unstable; urgency=low

  * Major rewriting of the postinst. 
    Better process, for the automatic mode, we now create a default bugzilla
    user instead of using debian-sys-maint.
  * The automatic installation is now aware of existing database, if the db
    name filled in Debconf is found, it will use it instead of creating a new one.
    (closes: #286827)
  * Added French translation of Debconf screens added in previous NMU.
  * It is now not allowed to set an invalid cookie path in the preferences CGI.
    (closes: #213420)
  * Added debian-init.pl to perform some initialisation. Can print a small
    error message if globals.pl is not readable.
    (closes: #284768)
  * Added a control of the first argument given to postinst, to fit the
    Policy (only 'configure' will let the process go).
  * Added a debug facility in postinst for better debugging when needed.
  * Added Alexis Sukrieh as a co-maintainer.

 -- Alexis Sukrieh <sukria@sukria.net>  Tue,  4 Jan 2005 10:56:30 +0100

bugzilla (2.16.7-0.2) unstable; urgency=medium

  * NMU 0-days due to serious/important bug solving which prevents
    bugzilla entering testing.

  [ Alexis Sukrieh ]

  * Post-inst won't fail anymore when no MySQL server is
    available. Added an automatic way of setting up the MySQL server if
    /etc/mysql/debian.cnf exists, will read values from it then.
    (closes: #250638)
  * Using a MySQL user with '-' inside its name won't fail anymore.
    (closes unreported bug)
  * Better handling on DBI connection errors. When DBI complains about
    something, user is not confused anymore by ugly error messages.
    (closes: #154249)
  * Running checksetup.pl by hand won't break the Bugzilla's installation
    anymore. User can use it as he want without running dpkg-reconfigure.
    (closes: #200707)

  [ Francesco P. Lovergine ]

  * Now rules removes .cvsignore file which trashes /usr/share/bugzilla/template.
  * Added virtual package httpd to the list of web server.
    (closes: #213784)

 -- Francesco Paolo Lovergine <frankie@debian.org>  Tue,  7 Dec 2004 22:54:45 +0100

bugzilla (2.16.7-0.1) unstable; urgency=low

  * NMU 0-days due to major security issues, solved upstream.
  * New upstream release:
    - Fix security relevant bug CAN-2004-0704:
      Remote attackers were allowed to view hidden products
      (closes: #260772)
    - Fix security relevant bugs CAN-2004-0705:
      Several Cross-Site-Scripting bugs allowed remote attackers
      to execute Javascript-Code with other users' privileges
      (closes: #260773)
    - Fix security relevant bug CAN-2004-0707:
      An SQL injection vulnerability allowed remote attackers which
      had the privilege to grant group membership privileges to
      execute arbitrary SQL commands
      (closes: #260774)
  * Include complete copyright statements collected from the sources
    (closes: #253841)

  Thanks Moritz Muehlenhoff for initial packaging.

 -- Francesco Paolo Lovergine <frankie@debian.org>  Tue, 26 Oct 2004 16:09:03 +0200

bugzilla (2.16.5-2) unstable; urgency=low

  * Duplicate table creation is now also fixed in bugzilla.postinst
    (closes: #224288)

 -- Rémi Perrot <rperrot@debian.org>  Fri,  2 Apr 2004 01:13:32 +0200

bugzilla (2.16.5-1) unstable; urgency=low

  * New upstream version
    - fix bug that make checksetup.pl try to create table that already
      exists (closes: #224288).
  * Don't print password when LDAP login failed any more (closes: #211103)
  * No any more Arch(tla) cruft (closes: #236954)
  * Add Japanese po-debconf template translation, thanks to Hideki Yamane
    (closes: #239209)
  * Add Dutch (nl) po-debconf template translation, thanks to Luk Claes
    (closes: #240030)
  * Change header.html.tmpl to make browser handle non iso-latin1 chars
    (closes: #222320)

 -- Rémi Perrot <rperrot@debian.org>  Wed, 31 Mar 2004 01:07:39 +0200

bugzilla (2.16.4-2) unstable; urgency=low

  * Fix bad default config state that makes bugzilla be
    initially installed with LDAP enabled (closes: #221878)
  * Convert changelog and control file to UTF-8 

 -- Rémi Perrot <rperrot@debian.org>  Sat, 22 Nov 2003 18:16:11 +0100

bugzilla (2.16.4-1) unstable; urgency=low

  * New upstream version that mostly fix some security issue
    To have more information have a look on upstream bug
    - http://bugzilla.mozilla.org/show_bug.cgi?id=214290
    - http://bugzilla.mozilla.org/show_bug.cgi?id=219044
    - http://bugzilla.mozilla.org/show_bug.cgi?id=219690
    - http://bugzilla.mozilla.org/show_bug.cgi?id=209376
  * Putting debian-doc in docs section
  * Remove dependency on roxen2 (closes: #214213)
  * Add Brazilian translation (closes: #198437)

 -- Rémi Perrot <rperrot@debian.org>  Wed, 12 Nov 2003 20:50:48 +0100

bugzilla (2.16.3-1) unstable; urgency=low

  * New upstream version closing some cross site scripting bug
  * Add explanation on how to customize template in README.Debian
    (closes: #165519).
  * In cron.daily, test for commands before running them as cron.daily
    stay in place if the package is uninstalled but not purged
    (closes: #187806).
  * French debcon templates improvement (closes: #190115).

 -- Rémi Perrot <rperrot@debian.org>  Sun, 27 Apr 2003 01:01:46 +0200

bugzilla (2.16.2-1) unstable; urgency=low

  * New upstream version that fix some security issue (DSA-218)
  * Fix typo in importxml.pl (closes: #173839)
  * Fix cut and paste bug in CGI.pl (closes: #181301)
  * Now use po-debconf for debconf template
  * Add some missing translation in french debconf template translation
  * Use dbh->tables() insted of deprecated _ListTables in bugzilla.postinst
  * Change a relative path to data directory to an absolute on in global.pl 

 -- Rémi Perrot <rperrot@debian.org>  Fri, 14 Mar 2003 23:51:29 +0100

bugzilla (2.16.1-1) unstable; urgency=low

  * New upstream version
  * Fix wrong path for processmail (closes: #164186, #159844)
  * Improve a little the French debconf template (closes: #166770) 

 -- Rémi Perrot <rperrot@debian.org>  Thu, 31 Oct 2002 14:42:34 +0100

bugzilla (2.16.0-2.1) unstable; urgency=high

  * Non-maintainer upload by security team
  * Fixed bit handling for new products to avoid errors in group handling
    triggered by not exact Perl maths beyond 2^48.  Backport from new
    upstream 2.14.4.

 -- Martin Schulze <joey@infodrom.org>  Thu, 10 Oct 2002 12:24:37 +0200

bugzilla (2.16.0-2) unstable; urgency=low

  * Fix wrong path to processmail in post_bug.cgi (closes: #159312).
  * Fix wrong path to lib votes.cgi (closes: #159551).
  * Prevent interpretation of meta char in password.
  * Fix bug on multi-world product when setting file
    permission. Thanks to Nathaniel W. Turner (closes: #159353).
  * Fix a typo in list.html.tmpl (closes: #159613).
  * Fix unreachable bugzilla.dtd bug (closes: #159600).   

 -- Rémi Perrot <rperrot@debian.org>  Thu,  5 Sep 2002 00:20:19 +0200

bugzilla (2.16.0-1) unstable; urgency=low

  * New upstream version (closes: #155952).
  ** Fix trim function (closes: #155945).
  ** Using templates makes some bugs obsolete
     (closes: #155748)
  * Fix some broken html links (closes: #154780).
  * Add dependancy alternative on http server (closes: #158378).
  * Fix a typo in debconf template (closes: #154464).
  * Add Suggest on libnet-ldap-perl (closes: #155984).

 -- Rémi Perrot <rperrot@debian.org>  Fri, 30 Aug 2002 21:34:07 +0200

bugzilla (2.14.2-3) unstable; urgency=low

  * Fix missing images directory in bugzilla-doc (closes: #153470).
  * Apply Daniel Patterson patch to make LDAP support available
    on the Debian version of Bugzilla (closes: #152583).

 -- Rémi Perrot <rperrot@debian.org>  Sun, 21 Jul 2002 01:33:56 +0200

bugzilla (2.14.2-2) unstable; urgency=low

  * Give a chance to install a MySQL server by saying that there is
    no server available in the configure script (closes: #145525).
  * Fix bad link to plain HTML pages (closes: #149255).
  * Set default urlbase to http://localhost/cgi-bin/bugzilla.
  * Provide dummy default to answer of debconf question that
    cause infinite loop if they are empty when the config srcipt run
    with a non interactive fronted (closes: #149305).

 -- Rémi Perrot <rperrot@debian.org>  Sun,  9 Jun 2002 21:49:46 +0200

bugzilla (2.14.2-1) unstable; urgency=high

  * New upstream version that fix several security hole.

 -- Rémi Perrot <rperrot@debian.org>  Sun,  9 Jun 2002 10:58:44 +0200

bugzilla (2.14.1-8) unstable; urgency=low

  * Fix path to processmail in createattachment.cgi (closes: #147111).
  * Same thing in importxml.pl.
  * Fix incorrect ref on 1x1.gif in long_list.cgi (closes: #147113).
  * Fix bad data directory path in move.pl, checksetup.pl and
    duplicates.cgi

 -- Rémi Perrot <rperrot@debian.org>  Sun, 19 May 2002 16:34:56 +0200

bugzilla (2.14.1-7) unstable; urgency=low

  * Fix bugzilla.postinst to make it accept quote in bugzilla admin
    name (closes: #145035).
  * Now recommands mysql-server.
  * Reset some field in bugzilla.config to avoid infinit loop
    (closes: #143456)

 -- Rémi Perrot <rperrot@debian.org>  Sun,  5 May 2002 22:50:46 +0200

bugzilla (2.14.1-6) unstable; urgency=low

  * Fix improper handling of "rebuildkeywordcache" in sanitycheck.cgi
    upstream bug #83474 (closes: #138174)
  * Fix bad link to html document in bug_form.pl (closes: #139118). 

 -- Rémi Perrot <rperrot@debian.org>  Wed, 20 Mar 2002 21:34:39 +0100

bugzilla (2.14.1-5) unstable; urgency=low

  * Checksetup.pl will not any more verify existence of Perl modules
    (closes: 135200,135201).
  * libxml-parser-perl is now only recommended.

 -- Rémi Perrot <rperrot@debian.org>  Sat,  2 Mar 2002 17:29:25 +0100

bugzilla (2.14.1-4) unstable; urgency=low

  * In Bugzilla postinst, redirect sdtout of checksetup.pl in
    stderr to prevent to confuse debconf.
  * In Bugzilla postinst, only reset mysql 'root' password when
    needed.
  * Fix problem about version number of Chart::Base (closes: #132593)
  * Fix incorrect handling of line by editparams.cgi on Mac
    (closes: #132937).

 -- Rémi Perrot <rperrot@debian.org>  Sun, 17 Feb 2002 12:02:15 +0100

bugzilla (2.14.1-3) unstable; urgency=low

  * Apply fix to the French template done by Denis Barbier
    (closes: #132385).

 -- Rémi Perrot <rperrot@debian.org>  Tue,  5 Feb 2002 21:34:26 +0100

bugzilla (2.14.1-2) unstable; urgency=low

  * Typo in description (closes: #129704).
  * Problem in localconfig.js (closes: #129363).

 -- Rémi Perrot <rperrot@debian.org>  Sun, 20 Jan 2002 17:52:11 +0100

bugzilla (2.14.1-1) unstable; urgency=high

  * Cleanup bugzilla postinst.
  * Typo in bugzilla-doc descriptions (closes: #124470).
  * New upstream that fix some security issue (closes: #128103).

 -- Rémi Perrot <rperrot@debian.org>  Mon,  7 Jan 2002 19:20:33 +0100

bugzilla (2.14-7) unstable; urgency=low

  * Fix an infinit loop in bugzilla postinst.
  * Typo in bugzilla-doc description. 

 -- Rémi Perrot <rperrot@debian.org>  Thu, 22 Nov 2001 23:15:07 +0100

bugzilla (2.14-6) unstable; urgency=low

  * Fix wrong variable name in showdependencygraph.cgi
    (closes: #120045). 

 -- Rémi Perrot <rperrot@debian.org>  Sun, 18 Nov 2001 12:17:56 +0100

bugzilla (2.14-5) unstable; urgency=low

  * Change depends on libchart-perl into recommends.
  * Remove depends on libgd-perl.
  * Fix missing 'use lib' in token.cgi (closes: #119890).

 -- Rémi Perrot <rperrot@debian.org>  Sat, 17 Nov 2001 22:02:02 +0100

bugzilla (2.14-4) unstable; urgency=low

  * Oops template upgrade have been left behind. All improvement
    proposed by Branden Robinson should have been incorporate now.
  * backing out Swedish translation until it has been sync with
    new template.

 -- Rémi Perrot <rperrot@debian.org>  Thu,  1 Nov 2001 00:08:48 +0100

bugzilla (2.14-3) unstable; urgency=low

  * Improve configuration script.
  * Improve all Debian english text. Thanks to Branden Robinson.
  * Bugzilla now depends on the latest version of libchart-perl. 
  * Make graph image working.
  * Update README.debian mostly by removing things in
    relation with cvs snapshoot.

 -- Rémi Perrot <rperrot@debian.org>  Mon, 29 Oct 2001 00:58:15 +0100

bugzilla (2.14-2) unstable; urgency=low

  * Remove unused and buggy field when creating
    admin profile (closes: #115115).

 -- Rémi Perrot <rperrot@debian.org>  Wed, 10 Oct 2001 19:51:54 +0200

bugzilla (2.14-1) unstable; urgency=low

  * New upstream version.
  * Fix type in bugzilla admin user creation

 -- Rémi Perrot <rperrot@debian.org>  Tue,  9 Oct 2001 22:34:15 +0200

bugzilla (2.13+cvs20010819-1) unstable; urgency=low

  * New upstream version.
  * Update description in doc-base
  * CGI are now in /usr/lib/cgi-bin/bugzilla
    (closes: #104151)
  * Try to prevent downgrade to bugzilla version that haven't
    the same database structure. This will not be effective
    when downgrading to version prior to this one.
  * Change Build-Depends to Build-Depends-Indep 

 -- Rémi Perrot <rperrot@debian.org>  Sun,  7 Oct 2001 20:42:31 +0200

bugzilla (2.13+cvs20010709-3) unstable; urgency=low

  * Improve bugzilla-doc description (closes: #108217).
  * Fix some link in bug_form.pl (closes: #109090).
  * Fix 'Use of uninitialized value' warning in process_bug.cgi
    (closes: #108731).
  * Restrict debconf depends to the newest version to make
    installation nicely failed on potato (closes: #107282).
  * Add German translation to debconf. Thanks to Joerg Rieger
    (closes: #108896).

 -- Rémi Perrot <rperrot@debian.org>  Mon, 20 Aug 2001 02:34:29 +0200

bugzilla (2.13+cvs20010709-2) unstable; urgency=low

  * Change bonsai uri link and add one that report diff
    between upstream version in README.Debian.
  * Fix typo in collectstats.pl

 -- Rémi Perrot <rperrot@debian.org>  Mon, 16 Jul 2001 22:19:01 +0200

bugzilla (2.13+cvs20010709-1) unstable; urgency=low

  * New upstream version (older version has always been 2.13, 
    1.13 number is a mistake sorry).
  * Add dependency on libxml-parser-perl.
  * Synchronize the Makefile with the new upstream version.
  * /usr/share/bugzilla/web/index.html is now a link to.
    /var/lib/bugzilla/web/index.html since as a conffile it
    can't be in /usr.
  * Fix broken link in editusers.cgi
		    
 -- Rémi Perrot <rperrot@debian.org>  Sun, 15 Jul 2001 20:39:07 +0200

bugzilla (1.13+cvs20010521-9) unstable; urgency=low

  * Fix postinst to deal with product with space (closes: #104477).
  * Missing where clause that give to all previously registred user
    admin's privilages. Thanks to Kestutis Kupciunas (closes : #104520).
  * Fix duplicate lines in initial localconfig.

 -- Rémi Perrot <rperrot@debian.org>  Sat, 14 Jul 2001 01:08:58 +0200

bugzilla (1.13+cvs20010521-8) unstable; urgency=low

  * Declare /usr/share/bugzilla/web/index.html as a conffile
    (closes: #104150)
  * Fix several links (closes: #104152)
  * Fix a syntax error in processmail (closes: #104353)

 -- Rémi Perrot <rperrot@debian.org>  Wed, 11 Jul 2001 22:28:21 +0200

bugzilla (1.13+cvs20010521-7) unstable; urgency=low

  * Tune files and dir perimissions in /var/lib/bugzilla
    (closes: #103417).
  * Add cron jobs.

 -- Rémi Perrot <rperrot@debian.org>, Sun,  8 Jul 2001 01:00:00 +0200

bugzilla (1.13+cvs20010521-6) unstable; urgency=low

  * Fix some path that prevent mail sending and shodowdb syncing.
  * Fix 'Use of uninitialized value' warning in CGI.pl
  * Do not ask to check password if there is no password asked
    before
  * Remove explicite call to postinst in config script

 -- Rémi Perrot <rperrot@debian.org>  Thu,  5 Jul 2001 23:16:34 +0200

bugzilla (1.13+cvs20010521-5) unstable; urgency=low

  * Add Swedish translation to debconf. Thanks Martin Sj|gren
    (closes: #103365).
  * Add French translation to debconf. Thanks to my wife.

 -- Rémi Perrot <rperrot@debian.org>  Tue,  3 Jul 2001 22:54:41 +0200

bugzilla (1.13+cvs20010521-4) unstable; urgency=low

  * Use debhelp script hook in postinst
  * Change all '|| die' by 'or die' to prevent precedence problem
  * Add || true after all db_* in bugzilla.config (closes: #102129)

 -- Rémi Perrot <rperrot@debian.org>  Sun,  1 Jul 2001 00:23:27 +0200

bugzilla (1.13+cvs20010521-3) unstable; urgency=low

  * Fix bugzilla-doc installation (closes: #101395).
  * Add symlink /usr/doc/bugzilla /usr/share/doc/bugzilla.
  * Fix broken link in enter_bug.cgi.
  * Change some default parameters :
     - sendmailnow On (This prevent bugs with non sendmail MTA)
     - entryheaderhtml -> change the path.
  * Make postinst forget mysql admin user password insted of bugzilla
    database user one.

 -- Rémi Perrot <rperrot@debian.org>, Tue, 19 Jun 2001 07:54:00 +0200

bugzilla (1.13+cvs20010521-2) unstable; urgency=low

  * Add suggest on bugzilla to bugzilla-doc and vice versa (closes: #101366)
  * Correct a typo in bugzilla-doc description.
  * Prevent conflict with viewcvs on query.cgi (closes: #101401).
    This may break compatibility with other mozilla webtools.
  * I miss all patches on bugzilla native source, sorry.

 -- Rémi Perrot <rperrot@debian.org>  Tue, 19 Jun 2001 06:44:43 +0200

bugzilla (1.13+cvs20010521-1) unstable; urgency=low

  * Initial Release.
  * Close the ITP (closes: #73038)

 -- Rémi Perrot <rperrot@debian.org>  Sun, 17 Jun 2001 18:35:12 +0200

Local variables:
mode: debian-changelog
End: