ikiwiki 3.20150329 released with these changes. This is a security update fixing a cross-site scripting vulnerability.

[ Joey Hess ]

  • Fix NULL ptr deref on ENOMEM in wrapper. (Thanks, igli)

    [ Simon McVittie ]

  • Really don't double-decode CGI submissions, even on Perl versions that bundle an old enough Encode.pm for that not to be a problem: the system might have a newer Encode.pm installed separately, like Fedora 20. (Closes: Debian bug #776181; thanks, Anders Kaseorg)

  • If neither timezone nor TZ is set, set both to :/etc/localtime if we're on a GNU system and that file exists, or GMT otherwise
  • t/inline.t: accept translations of "Add a new post titled:" (Closes: Debian bug #779365)
  • Consistently document command-line options as e.g. --refresh, not -refresh

    [ Amitai Schlair ]

  • In VCS-committed anonymous comments, link to url.

    [ Joey Hess ]

  • Fix XSS in openid selector. Thanks, Raghav Bisht. (Closes: Debian bug #781483)

In addition, version 3.20141016.2 was released on the same day to backport the cross-site-scripting fix to Debian 8.