Package "php-htmlpurifier"

php-htmlpurifier (4.3.0+dfsg1-1) unstable; urgency=low

  * New upstream release; upstream WHATSNEW says:
    │HTML Purifier 4.3.0 is a major security release addressing various
    │security vulnerabilities related to user-submitted code and
    │legitimate client-side scripts. It also contains an accumulation of
    │new features and bugfixes over half a year. New configuration
    │options include %CSS.Trusted, %CSS.AllowedFonts and
    │%Cache.SerializerPermissions. There is a backwards-incompatible API
    │change for customized raw definitions, see
    │ for
    │details.
  * Document that %Cache.SerializerPath *MUST* be used, because the
    upstream standard location cannot be written to in a packaged
    version (being system-global) for security reasons. Also switch
    %Cache.DefinitionImpl from "Serializer" to NULL to make the
    standard installation, although with degraded performance, work
    as-is. Document in README.Debian. (Closes: #611305)
  * Solves TEMP-0000000-196897 security issue.

 -- Thorsten Glaser Sat, 02 Apr 2011 16:55:15 +0000