v0.0.42 security fix (deny functions) Fixes #63

Author: DSpeichert

History.md

@@ -1,5 +1,15 @@
 ## vNEXT
 
+## v0.0.42
+
+* Critical security bug fixed (deny function were not enforced)
+
+## v0.0.41
+
+* fix compat with 0.8.3
+* initial but broken laika 0.9 support
+* fix for tests
+
 ## v0.0.40
 
 * Fixes for breaking changes in private Blaze API in Meteor 0.9.1

lib/mfPkg/messageformat.js

@@ -84,7 +84,7 @@ mfPkg = {
         },
         denied: function() {
             var self = this, args = arguments;
-            return _.every(mfPkg.webUI.allowFuncs, function(func) {
+            return _.every(mfPkg.webUI.denyFuncs, function(func) {
                 return !func.apply(self, args);
             });
         }

package.js

@@ -1,6 +1,6 @@
 Package.describe({
   name:    "gadicohen:messageformat",
-  version: "0.0.41",
+  version: "0.0.42",
   summary: "MessageFormat support, the Meteor way",
   git:      "https://github.com/gadicc/meteor-messageformat.git",
 });

smart.json

@@ -3,7 +3,7 @@
     "description": "MessageFormat support, i18n the Meteor way",
     "homepage": "https://github.com/gadicohen/meteor-messageformat",
     "author": "Gadi Cohen <dragon@wastelands.net>",
-    "version": "0.0.41",
+    "version": "0.0.42",
     "git": "https://github.com/gadicohen/meteor-messageformat.git",
 	"packages": {
 		"headers": "0.0.24"

versions.json

@@ -2,7 +2,11 @@
   "dependencies": [
     [
       "application-configuration",
-      "1.0.1"
+      "1.0.2"
+    ],
+    [
+      "base64",
+      "1.0.0"
     ],
     [
       "binary-heap",
@@ -16,6 +20,10 @@
       "blaze-tools",
       "1.0.0"
     ],
+    [
+      "boilerplate-generator",
+      "1.0.0"
+    ],
     [
       "callback-hook",
       "1.0.0"
@@ -34,7 +42,7 @@
     ],
     [
       "ejson",
-      "1.0.1"
+      "1.0.2"
     ],
     [
       "follower-livedata",
@@ -58,7 +66,7 @@
     ],
     [
       "htmljs",
-      "1.0.0"
+      "1.0.1"
     ],
     [
       "id-map",
@@ -94,23 +102,23 @@
     ],
     [
       "logging",
-      "1.0.2"
+      "1.0.3"
     ],
     [
       "meteor",
-      "1.0.3"
+      "1.1.0"
     ],
     [
       "minifiers",
-      "1.0.2"
+      "1.1.0"
     ],
     [
       "minimongo",
-      "1.0.2"
+      "1.0.3"
     ],
     [
       "mongo",
-      "1.0.4"
+      "1.0.5"
     ],
     [
       "observe-sequence",
@@ -138,7 +146,7 @@
     ],
     [
       "routepolicy",
-      "1.0.0"
+      "1.0.1"
     ],
     [
       "session",
@@ -154,7 +162,7 @@
     ],
     [
       "templating",
-      "1.0.5"
+      "1.0.6"
     ],
     [
       "tracker",
@@ -170,10 +178,14 @@
     ],
     [
       "webapp",
-      "1.0.3"
+      "1.1.1"
+    ],
+    [
+      "webapp-hashing",
+      "1.0.0"
     ]
   ],
   "pluginDependencies": [],
-  "toolVersion": "meteor-tool@1.0.28",
+  "toolVersion": "meteor-tool@1.0.31",
   "format": "1.0"
 }