3.20160509~bpo8+1

[git.ikiwiki.info.git] / debian / NEWS

diff --git a/debian/NEWS b/debian/NEWS
index c1f343520fa65a970c6d3eeaf2c56ffa28bb6316..e169658ea28b4f362b5528a98a34daad4e4e7848 100644 (file)
--- a/debian/NEWS
+++ b/debian/NEWS
@@ -1,4 +1,28 @@
-ikiwiki (3.20150330) UNRELEASED; urgency=medium
+ikiwiki (3.20160506) unstable; urgency=medium
+
+  To mitigate CVE-2016-3714 and similar ImageMagick security vulnerabilities,
+  the [[!img]] directive is now restricted to these common web formats by
+  default:
+
+  * JPEG (.jpg, .jpeg)
+  * PNG (.png)
+  * GIF (.gif)
+  * SVG (.svg)
+
+  (In particular, by default resizing PDF files is no longer allowed.)
+
+  Additionally, resized SVG files are displayed in the browser as SVG
+  instead of being converted to PNG.
+
+  If all users who can attach images are fully trusted, this restriction
+  can be removed with the new img_allowed_formats setup option.
+  See <https://ikiwiki.info/ikiwiki/directive/img/>
+  or <file:///usr/share/doc/ikiwiki/html/ikiwiki/directive/img.html> for
+  more details.
+
+ -- Simon McVittie <smcv@debian.org>  Fri, 06 May 2016 07:49:56 +0100
+
+ikiwiki (3.20150610) unstable; urgency=low

 
   The new "emailauth" plugin allows users to authenticate using an email
   address, without otherwise creating an account.
 
   The new "emailauth" plugin allows users to authenticate using an email
   address, without otherwise creating an account.


@@ -8,7 +32,7 @@ ikiwiki (3.20150330) UNRELEASED; urgency=medium
   Conversely, if emailauth is required on a wiki that does not enable
   openid, you can list it in the enable_plugins setting.
 
   Conversely, if emailauth is required on a wiki that does not enable
   openid, you can list it in the enable_plugins setting.
 

- -- Simon McVittie <smcv@debian.org>  Wed, 27 May 2015 08:30:43 +0100
+ -- Simon McVittie <smcv@debian.org>  Wed, 10 Jun 2015 21:56:56 +0100

 
 ikiwiki (3.20150107) experimental; urgency=medium
 
 
 ikiwiki (3.20150107) experimental; urgency=medium