You are viewing a plain text version of this content. The canonical link for it is here.
- Re: [PR] Use the current Roller session during OAuth authorization [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 04:10:23 UTC, 4 replies.
- Re: [PR] Retire the WSSE AtomPub authentication mode [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 04:13:12 UTC, 1 replies.
- Re: [PR] Separate submitted and response salts in UI filters [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 04:15:33 UTC, 3 replies.
- Re: [PR] Normalize frontpage directory parameters before rendering the bundled theme [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 04:20:03 UTC, 2 replies.
- Re: [PR] Store enclosure metadata without fetching remote URLs [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 04:32:01 UTC, 2 replies.
- Re: [PR] Scope authoring resource lookups to the action weblog [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:01 UTC, 1 replies.
- Re: [PR] Check weblog permission in XML-RPC Blogger/MetaWeblog handlers [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:14 UTC, 2 replies.
- Re: [PR] Move authoring UI inline JS handlers to data attributes [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:16 UTC, 1 replies.
- Re: [PR] Move frontpage selection into the administrator setup workflow [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:20 UTC, 1 replies.
- Re: [PR] Resolve weblog template resources within the active theme [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:22 UTC, 2 replies.
- Re: [PR] Disable vendor extension types on the XML-RPC servlet [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:22 UTC, 1 replies.
- Re: [PR] Use a shared JDOM builder for bookmark and configuration parsing [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:28 UTC, 2 replies.
- Re: [PR] Derive media content types from file content, not the request [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:28 UTC, 3 replies.
- Re: [PR] Retire incoming Trackback support and normalize comment links [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/01 17:44:39 UTC, 6 replies.
- Re: [PR] Use double-quoted attributes in media file links inserted into new entries [roller] - posted by "mbien (via GitHub)" <gi...@apache.org> on 2026/09/05 09:14:30 UTC, 3 replies.
- Re: [PR] Replace ROME Propono AtomPub server with self-contained StAX implementation [roller] - posted by "mbien (via GitHub)" <gi...@apache.org> on 2026/09/05 09:24:05 UTC, 0 replies.
- Re: [PR] Remove legacy outbound trackback action [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/05 20:06:29 UTC, 0 replies.
- [PR] Fix release signing script argument handling and checksums [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/05 20:40:15 UTC, 1 replies.
- [PR] Add release notes and stop shipping third-party jars in the source release [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/06 00:38:51 UTC, 1 replies.
- [PR] Update dependencies across project and add JDK 25 to test matrix [roller] - posted by "mbien (via GitHub)" <gi...@apache.org> on 2026/09/06 02:25:11 UTC, 2 replies.
- Re: [PR] Replace the Selenium suite with Playwright browser tests run across all auth methods [roller] - posted by "mbien (via GitHub)" <gi...@apache.org> on 2026/09/06 03:43:13 UTC, 1 replies.
- Re: [PR] build and sonar added [roller] - posted by "mbien (via GitHub)" <gi...@apache.org> on 2026/09/06 04:12:41 UTC, 1 replies.
- [VOTE] Release Apache Roller 6.1.6 RC1 - posted by Dave <sn...@gmail.com> on 2026/09/06 11:43:26 UTC, 1 replies.
- Re: [PR] Bump spring-security-config from 5.8.3 to 5.8.5 in /app [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/07 02:43:02 UTC, 2 replies.
- Re: [PR] Bump struts2-core from 2.5.29 to 2.5.31 in /app [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/07 02:43:10 UTC, 2 replies.
- Re: [PR] Bump spring-web from 5.3.20 to 6.0.0 in /app [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/07 02:43:20 UTC, 2 replies.
- testing 6.1.6 RC1 - posted by Greg Huber <gr...@gmail.com> on 2026/09/07 13:50:21 UTC, 1 replies.
- [PR] Use double-quoted href attributes on the comment management page [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/07 17:01:06 UTC, 1 replies.
- [PR] Improve installer form initialization and preview navigation [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/07 18:45:58 UTC, 6 replies.
- [CANCEL][VOTE] Release Apache Roller 6.1.6 RC1 - posted by Dave <sn...@gmail.com> on 2026/09/07 21:20:09 UTC, 0 replies.
- [VOTE] Release Apache Roller 6.1.6 RC2 - posted by Dave <sn...@gmail.com> on 2026/09/07 21:31:15 UTC, 3 replies.
- Note on Roller compatibility with the latest H2 database (H2 2.5.250) - posted by Richard via dev <de...@roller.apache.org> on 2026/09/08 02:24:39 UTC, 2 replies.
- [PR] Fix blank Font Awesome icons in preset themes (CSP font-src) and document H2 VALUE workaround [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/08 11:06:18 UTC, 1 replies.
- [PR] Track schema upgrades with a flag instead of a hardcoded version check [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/08 12:04:03 UTC, 1 replies.
- [PR] Fix jQuery UI 404 on authoring pages (drop webjar +1 suffix from head.jsp URL) [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/09 21:08:02 UTC, 1 replies.
- [CANCEL][VOTE] Release Apache Roller 6.1.6 RC2 - posted by Dave <sn...@gmail.com> on 2026/09/10 20:46:22 UTC, 0 replies.
- [VOTE] Release Apache Roller 6.1.6 RC3 - posted by Dave <sn...@gmail.com> on 2026/09/11 01:46:24 UTC, 2 replies.
- [PR] Add a roller-release developer skill documenting the release procedure [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/11 21:24:39 UTC, 1 replies.
- [PR] Add a roller-security developer skill for report triage and coordination [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/11 21:25:40 UTC, 1 replies.
- [PR] Make sure bootstrap tables.less .table-striped > tbody > tr:nth-of-type(2n+1) is overridden [roller] - posted by "gregh3269 (via GitHub)" <gi...@apache.org> on 2026/09/13 10:09:19 UTC, 1 replies.
- [PR] Secure initial Roller setup with one-time operator token [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/13 13:05:59 UTC, 7 replies.
- [PR] Normalize links in HTML subset formatting [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/14 23:07:16 UTC, 5 replies.
- [PR] Format LDAP comment form values consistently [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/14 23:08:18 UTC, 4 replies.
- [PR] Bump org.apache.struts:struts2-core from 2.5.29 to 6.8.0 in /app [roller] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/17 22:46:54 UTC, 2 replies.
- [VOTE] Release Apache Roller 6.1.6 (RC4) - posted by Dave <sn...@gmail.com> on 2026/09/17 23:28:32 UTC, 6 replies.
- [PR] No single quotes in media file insert url on mediaFileAdd!save.rol [roller] - posted by "gregh3269 (via GitHub)" <gi...@apache.org> on 2026/09/19 10:21:54 UTC, 5 replies.
- [PR] Bump org.freemarker:freemarker from 2.3.23 to 2.3.35 in /sources [roller-website] - posted by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/09/24 19:20:46 UTC, 1 replies.
- [RESULT][VOTE] Release Apache Roller 6.1.6 (RC4) - posted by Dave <sn...@gmail.com> on 2026/09/24 22:04:57 UTC, 0 replies.
- [ANNOUNCE] Apache Roller 6.1.6 released - posted by Dave <sn...@gmail.com> on 2026/09/24 23:06:21 UTC, 0 replies.
- Re: [PR] [INFRA] Set up default rulesets for default and release branches [roller-website] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/25 15:07:18 UTC, 0 replies.
- Re: [PR] Include jquery instead of getting it from ajax.googleapis.com [roller-website] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/25 15:08:39 UTC, 0 replies.
- [PR] Add the ASF license header to source files that were missing it [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/25 17:32:01 UTC, 2 replies.
- Re: [PR] ROL-2183: Migrate from javax to Jakarta EE 11 [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/25 18:27:31 UTC, 1 replies.
- CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:29 UTC, 0 replies.
- CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:35 UTC, 0 replies.
- CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:40 UTC, 0 replies.
- CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:52 UTC, 0 replies.
- CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:57 UTC, 0 replies.
- CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:02 UTC, 0 replies.
- CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:25 UTC, 0 replies.
- CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:30 UTC, 0 replies.
- CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:36 UTC, 0 replies.
- CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:42 UTC, 0 replies.
- CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:13:00 UTC, 0 replies.
- CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:13:09 UTC, 0 replies.
- CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:37 UTC, 0 replies.
- CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:41 UTC, 0 replies.
- CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:46 UTC, 0 replies.
- CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:50 UTC, 0 replies.
- [PR] Fold release and disclosure lessons into the release and security skills [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/25 20:58:18 UTC, 1 replies.
- Re: [PR] Fix incorrect PostgreSQL port in Dockerfile [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/25 21:22:07 UTC, 0 replies.
- [PR] Update the gaurav theme's jQuery and Bootstrap, drop unused jQuery 2.1.1 [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/26 14:51:47 UTC, 1 replies.
- 6.1.7 release to struts v6 - posted by Greg Huber <gr...@gmail.com> on 2026/09/27 07:45:08 UTC, 0 replies.
- roller on struts v7 - posted by Greg Huber <gr...@gmail.com> on 2026/09/27 08:01:51 UTC, 0 replies.
- Re: [PR] Add missing ASF license headers and check them with Apache RAT [roller] - posted by "mraible (via GitHub)" <gi...@apache.org> on 2026/09/27 20:10:45 UTC, 0 replies.
- [ANNOUNCE] Apache Roller 6.1.6 fixes 18 security vulnerabilities - posted by Dave <sn...@gmail.com> on 2026/09/27 20:57:59 UTC, 0 replies.
- [PR] Serve AtomPub through a Roller servlet [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/29 21:04:09 UTC, 0 replies.
- [PR] Keep wrapped pojos out of the template surface [roller] - posted by "snoopdave (via GitHub)" <gi...@apache.org> on 2026/09/29 21:21:27 UTC, 0 replies.