hashed password support, and empty password security fix

[git.ikiwiki.info.git] / debian / changelog

diff --git a/debian/changelog b/debian/changelog
index 16c5fa65c903d9bd9fe058b67e930db1b816b457..cdd8f8221db24696a1ca92af59d94d0b90081969 100644 (file)
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,8 @@
-ikiwiki (2.48) UNRELEASED; urgency=low
+ikiwiki (2.48) UNRELEASED; urgency=high

 
 

+  * Fix security hole that occurred if openid and passwordauth were both
+    enabled. passwordauth would allow logging in as a known openid, with an
+    empty password.

   * Add rel=nofollow to edit links. This may prevent some spiders from
     pounding on the cgi following edit links.
   * When calling decode_utf8 on known-problimatic content in aggregate,
   * Add rel=nofollow to edit links. This may prevent some spiders from
     pounding on the cgi following edit links.
   * When calling decode_utf8 on known-problimatic content in aggregate,


@@ -8,14 +11,12 @@ ikiwiki (2.48) UNRELEASED; urgency=low
     saying it is the default.
   * passwordauth: If Authen::Passphrase is installed, use it to store
     password hashes, crypted with Eksblowfish.
     saying it is the default.
   * passwordauth: If Authen::Passphrase is installed, use it to store
     password hashes, crypted with Eksblowfish.

-  * Existing cleartext passwords in the userdb will be automatically hashed
-    (if Authen::Passphrase is installed) the next time a user logs in.
-    Or `ikiwiki-transition hashpassword /path/to/srcdir` can be used to force
-    a conversion.
-  * Passwords will no longer be mailed, but instead a password reset link
-    mailed.
+  * `ikiwiki-transiition hashpassword /path/to/srcdir` can be used to
+    hash existing plaintext passwords.
+  * Passwords will no longer be mailed, but instead a password reset link.

   * The password_cost config setting is provided as a "more security" knob.
   * teximg: Fix logurl.
   * The password_cost config setting is provided as a "more security" knob.
   * teximg: Fix logurl.

+  * teximg: If the log isn't written, avoid ugly error messages.

 
  -- Joey Hess <joeyh@debian.org>  Wed, 28 May 2008 03:07:37 -0400
 
 
  -- Joey Hess <joeyh@debian.org>  Wed, 28 May 2008 03:07:37 -0400