Invenio v0.99.5

inveniosoftware · Feb 21, 2012 · 4317389 · 4317389
1 parent c4d7717
commit 4317389
Show file tree

Hide file tree

Showing 5 changed files with 53 additions and 34 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,19 @@
+CDS Invenio v0.99.5 (released 2012-02-21)
+=========================================
+
+2012-02-21  Tibor Simko  <[email protected]>
+
+	I18N: update PO files for the release of v0.99.5
+
+2012-02-14  Jerome Caffaro  <[email protected]>
+
+	WebComment: improve sanity checks
+	* When reporting, voting, or replying to a comment, or when accessing
+	  comment attachments, ensure that the comment belongs to the given
+	  record and is not deleted.  (For example, this prevents malicious
+	  users from attempting to indirectly reach comments in restricted
+	  collections by URL mangling.)
+
 CDS Invenio v0.99.4 (released 2011-12-19)
 =========================================
 

diff --git a/INSTALL b/INSTALL
@@ -183,13 +183,13 @@ Contents
 ----------------
 
       $ cd /usr/local/src/
-      $ wget http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz
-      $ wget http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz.md5
-      $ wget http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz.sig
-      $ md5sum -v -c cds-invenio-0.99.4.tar.gz.md5
-      $ gpg --verify cds-invenio-0.99.4.tar.gz.sig cds-invenio-0.99.4.tar.gz
-      $ tar xvfz cds-invenio-0.99.4.tar.gz
-      $ cd cds-invenio-0.99.4
+      $ wget http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz
+      $ wget http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz.md5
+      $ wget http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz.sig
+      $ md5sum -v -c cds-invenio-0.99.5.tar.gz.md5
+      $ gpg --verify cds-invenio-0.99.5.tar.gz.sig cds-invenio-0.99.5.tar.gz
+      $ tar xvfz cds-invenio-0.99.5.tar.gz
+      $ cd cds-invenio-0.99.5
       $ ./configure
       $ make
       $ make install
@@ -232,20 +232,20 @@ Contents
           CDS Invenio.  (The built files will be installed into
           different "target" directories later.)
 
-      $ wget http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz
-      $ wget http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz.md5
-      $ wget http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz.sig
+      $ wget http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz
+      $ wget http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz.md5
+      $ wget http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz.sig
 
           Fetch CDS Invenio source tarball from the CDS Software
           Consortium distribution server, together with MD5 checksum
           and GnuPG cryptographic signature files useful for verifying
           the integrity of the tarball.
 
-      $ md5sum -v -c cds-invenio-0.99.4.tar.gz.md5
+      $ md5sum -v -c cds-invenio-0.99.5.tar.gz.md5
 
           Verify MD5 checksum.
 
-      $ gpg --verify cds-invenio-0.99.4.tar.gz.sig cds-invenio-0.99.4.tar.gz
+      $ gpg --verify cds-invenio-0.99.5.tar.gz.sig cds-invenio-0.99.5.tar.gz
 
           Verify GnuPG cryptographic signature.  Note that you may
           first have to import my public key into your keyring, if you
@@ -257,11 +257,11 @@ Contents
           warning that may follow after the signature has been
           successfully verified.
 
-      $ tar xvfz cds-invenio-0.99.4.tar.gz
+      $ tar xvfz cds-invenio-0.99.5.tar.gz
 
           Untar the distribution tarball.
 
-      $ cd cds-invenio-0.99.4
+      $ cd cds-invenio-0.99.5
 
           Go to the source directory.
 

diff --git a/Makefile.am b/Makefile.am
@@ -1,5 +1,5 @@
 ## This file is part of CDS Invenio.
-## Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2011 CERN.
+## Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2011, 2012 CERN.
 ##
 ## CDS Invenio is free software; you can redistribute it and/or
 ## modify it under the terms of the GNU General Public License as
@@ -260,4 +260,7 @@ update-v0.99.2-tables:
 update-v0.99.3-tables:
 	@echo "Nothing to do; table structure did not change between v0.99.3 and v0.99.4."
 
+update-v0.99.4-tables:
+	@echo "Nothing to do; table structure did not change between v0.99.4 and v0.99.5."
+
 CLEANFILES = *~
diff --git a/NEWS b/NEWS
@@ -6,6 +6,13 @@ releases.  For more information about the current release, please
 consult RELEASE-NOTES.  For more information about changes, please
 consult ChangeLog.
 
+CDS Invenio v0.99.5 -- released 2012-02-21
+------------------------------------------
+
+ *) improved sanity checks when reporting, voting, or replying to a
+    comment, or when accessing comment attachments, preventing URL
+    mangling attempts (WebComment)
+
 CDS Invenio v0.99.4 -- released 2011-12-19
 ------------------------------------------
 

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
@@ -1,29 +1,27 @@
 --------------------------------------------------------------------
-CDS Invenio v0.99.4 is released
-December 19, 2011
+CDS Invenio v0.99.5 is released
+February 21, 2012
 http://invenio-software.org/
 --------------------------------------------------------------------
 
-CDS Invenio v0.99.4 was released on December 19, 2011.
+CDS Invenio v0.99.5 was released on February 21, 2012.
 
 This is a minor bugfix release only.  It is recommended to all CDS
-Invenio sites using v0.99.3 or previous releases.
+Invenio sites using v0.99.4 or previous releases.
 
 What's new:
 -----------
 
- *) fixed double stemming during indexing (BibRank)
-
- *) fixed collection translation in admin UI (WebSearch)
-
- *) fixed UP and DOWN functions for UTF-8 strings (BibConvert)
+ *) improved sanity checks when reporting, voting, or replying to a
+    comment, or when accessing comment attachments, preventing URL
+    mangling attempts (WebComment)
 
 Download:
 ---------
 
-  <http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz>
-  <http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz.md5>
-  <http://invenio-software.org/download/cds-invenio-0.99.4.tar.gz.sig>
+  <http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz>
+  <http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz.md5>
+  <http://invenio-software.org/download/cds-invenio-0.99.5.tar.gz.sig>
 
 Installation notes:
 -------------------
@@ -33,24 +31,19 @@ Please follow the INSTALL file bundled in the distribution tarball.
 Upgrade notes:
 --------------
 
-If you are upgrading from CDS Invenio v0.99.3, then:
+If you are upgrading from CDS Invenio v0.99.4, then:
 
  - please stop your bibsched queue and your Apache server
 
  - install the update:
 
-     $ cd cds-invenio-0.99.4
+     $ cd cds-invenio-0.99.5
      $ cp -a /opt/cds-invenio/etc /opt/cds-invenio/etc.OLD
      $ sh /opt/cds-invenio/etc/build/config.nice
      $ make install
      $ /opt/cds-invenio/bin/inveniocfg --update-all
      $ cp -a /opt/cds-invenio/etc.OLD /opt/cds-invenio/etc
 
- - in order to apply the double-stemming fix for the indexer,
-   reindexing of those indexes that use stemming is recommended:
-
-     $ bibindex -u admin --reindex
-
  - restart your Apache server and your bibsched queue
 
  - you are done