X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/2afb0dd66332136f47d08f2ee4de292eb73c8779..c142dba356b757facd6684a99623c58430b7221e:/debian/NEWS
diff --git a/debian/NEWS b/debian/NEWS
index c1f343520..e169658ea 100644
--- a/debian/NEWS
+++ b/debian/NEWS
@@ -1,4 +1,28 @@
-ikiwiki (3.20150330) UNRELEASED; urgency=medium
+ikiwiki (3.20160506) unstable; urgency=medium
+
+ To mitigate CVE-2016-3714 and similar ImageMagick security vulnerabilities,
+ the [[!img]] directive is now restricted to these common web formats by
+ default:
+
+ * JPEG (.jpg, .jpeg)
+ * PNG (.png)
+ * GIF (.gif)
+ * SVG (.svg)
+
+ (In particular, by default resizing PDF files is no longer allowed.)
+
+ Additionally, resized SVG files are displayed in the browser as SVG
+ instead of being converted to PNG.
+
+ If all users who can attach images are fully trusted, this restriction
+ can be removed with the new img_allowed_formats setup option.
+ See
+ or for
+ more details.
+
+ -- Simon McVittie Fri, 06 May 2016 07:49:56 +0100
+
+ikiwiki (3.20150610) unstable; urgency=low
The new "emailauth" plugin allows users to authenticate using an email
address, without otherwise creating an account.
@@ -8,7 +32,7 @@ ikiwiki (3.20150330) UNRELEASED; urgency=medium
Conversely, if emailauth is required on a wiki that does not enable
openid, you can list it in the enable_plugins setting.
- -- Simon McVittie Wed, 27 May 2015 08:30:43 +0100
+ -- Simon McVittie Wed, 10 Jun 2015 21:56:56 +0100
ikiwiki (3.20150107) experimental; urgency=medium