Proper handling of 'Create' permissions in both mail gateway (earlier

[roundup.git] / CHANGES.txt

diff --git a/CHANGES.txt b/CHANGES.txt
index 57afd30a7771bca8d43cbe0a5a1e4acb5f7e7344..0da596de9446ec2ecd5e9f83e1cc072f4c1706c6 100644 (file)
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,12 +1,24 @@
 This file contains the changes to the Roundup system over time. The entries
 are given with the most recent entry first.
 
-2009-12-XX 1.4.11 (rXXXX)
+2010-XX-XX 1.4.12 (rXXXX)
+
+Fixes:
+- Proper handling of 'Create' permissions in both mail gateway (earlier
+  commit r4405 by Richard) and web interface, this used to check 'Edit'
+  permission previously. See
+  http://thread.gmane.org/gmane.comp.bug-tracking.roundup.devel/5133
+  Add regression tests for proper handling of 'Create' and 'Edit'
+  permissions.
+
+2009-12-21 1.4.11 (r4411)
 
 Features:
 - Generic class editor may now restore retired items (thanks Ralf Hemmecke)
 
 Fixes:
+- Fix security hole allowing user permission escalation (thanks Ralf
+  Schlatterbeck)
 - More SSL fixes. SSL wants the underlying socket non-blocking. So we
   don't call socket.setdefaulttimeout in case of SSL. This apparently
   never raises a WantReadError from SSL.
@@ -46,6 +58,14 @@ Fixes:
   This also means now a template can override the way role processing
   occurs (e.g. for elaborate permission schemes). Thanks to intevation
   for funding the change.
+- Fix issue2550606 (german translation bug) "an hour" is only used in
+  the context "in an hour" or "an hour ago" which translates to german
+  "in einer Stunde" or "vor einer Stunde".  So "an hour" is translated
+  "einer Stunde" (which sounds wrong at first).  Also note that date.py
+  already has a comment saying "XXX this is internationally broken" --
+  but at least there's a workaround for german :-) Thanks to Chris
+  (radioking) for reporting.
+
 
 2009-10-09 1.4.10 (r4374)