Require Django Evolution 0.6.9 or higher.
Lock down the uploaded files a bit in default Apache configs.

The generated Apache configs now set some defaults that limit what can
be done in the uploaded directories. It prevents a .htaccess from
overriding settings, prevents other modules like php from executing, and
also sets some file types to appear as plaintext so that the browser
won't render them.

This is not a complete solution for protection against malicious files.
Older versions of IE don't care what mimetypes we use and will sniff for
HTML files, for instance. It's really up to the administrator to do some
heightened security precautions, which will be outlined in a KB article
separately.
Update the Recaptcha URLs for Google's new URLs.

Google updated the Recaptcha URLs to be hosted on google.com. While the
old HTTP URL still works (as a redirect), the old HTTPS URL doesn't seem
to be working.

We now make use of the new URLs.
Merge branch 'release-1.6.x' into release-1.7.x
Use an unguessable filename for all file attachment uploads.

FileAttachments now save with an unguessable filename. They contain the
real filename, but with a UUID prepended. This serves a couple purposes.

1) People can't guess/scan for common names.
2) Users can't craft malicious filenames with the intent to mess up an
   unsecured installation (such as naming a file .htaccess).

The original filename is stored in the database, which is useful for
display purposes. We never actually present the resulting filename
except in the HTML for linking/display.

The caption is now set to the filename by default, so there isn't
necessarily this weird "caption OR filename" thing. It's a sane default
that users can see and override.
Merge branch 'release-1.6.x' into release-1.7.x
Release Review Board 1.6.18.
Merge branch 'release-1.6.x' into release-1.7.x
Fix the list of dependencies.

These got messed up during a merge. We're now back at the proper 1.7.x
dependency list, plus an update for Djblets 0.7.16.
Don't add the new header if the review request doesn't have a repository.

The recent change to add a X-ReviewRequest-Repository header for e-mails
broke for review requests without a repository. It's now conditionally
added.
Release Review Board 1.6.18.
Merge branch 'release-1.6.x' into release-1.7.x
Release Review Board 1.7.12.
Update the docs database for the latest schema changes.
Bump to 1.6.19 dev.
Merge branch 'release-1.6.x' into release-1.7.x
Bump to 1.7.13 dev.
Add a missing release notes for CVE-2013-4795, fixed in 1.6.18.

This was a XSS vulnerability that was fixed as part of Djblets.
Merge branch 'release-1.6.x' into release-1.7.x
Add a missing release notes for CVE-2013-4795, fixed in 1.7.12.

This was a XSS vulnerability that was fixed as part of Djblets.