Exclude working directory from library path (CVE-2016-1238)

[git.ikiwiki.info.git] / doc / ikiwiki / directive / img.mdwn

diff --git a/doc/ikiwiki/directive/img.mdwn b/doc/ikiwiki/directive/img.mdwn
index fa3b40f50c21a0393ec7b9530f9303ae23ccd9c9..a940a44b6567ef72c9f8b23a8900a1545be508d0 100644 (file)
--- a/doc/ikiwiki/directive/img.mdwn
+++ b/doc/ikiwiki/directive/img.mdwn
@@ -41,4 +41,27 @@ the page, unless overridden. Useful when including many images on a page.
        \[[!img photo2.jpg]]
        \[[!img photo3.jpg size=200x600]]
 
+## format support
+
+By default, the `img` directive only supports a few common web formats:
+
+* PNG (`.png`)
+* JPEG (`.jpg` or `.jpeg`)
+* GIF (`.gif`)
+* SVG (`.svg`)
+
+These additional formats can be enabled with the `img_allowed_formats`
+[[!iki setup]] option, but are disabled by default for better
+[[!iki security]]:
+
+* PDF (`.pdf`)
+* `everything` (accepts any file supported by ImageMagick: make sure
+  that only completely trusted users can
+  [[upload attachments|ikiwiki/pagespec/attachment]])
+
+For example, a wiki where only `admin()` users can upload attachments might
+use:
+
+    img_allowed_formats: [png, jpeg, gif, svg, pdf]
+
 [[!meta robots="noindex, follow"]]