X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/c34b86f12e19324ad21c196b5a8ab9943e9e2a10..7269c9af3e55dc478792d8ea010ab9b794190a66:/debian/NEWS

diff --git a/debian/NEWS b/debian/NEWS
index b10a0f635..e169658ea 100644
--- a/debian/NEWS
+++ b/debian/NEWS
@@ -1,3 +1,39 @@
+ikiwiki (3.20160506) unstable; urgency=medium
+
+  To mitigate CVE-2016-3714 and similar ImageMagick security vulnerabilities,
+  the [[!img]] directive is now restricted to these common web formats by
+  default:
+
+  * JPEG (.jpg, .jpeg)
+  * PNG (.png)
+  * GIF (.gif)
+  * SVG (.svg)
+
+  (In particular, by default resizing PDF files is no longer allowed.)
+
+  Additionally, resized SVG files are displayed in the browser as SVG
+  instead of being converted to PNG.
+
+  If all users who can attach images are fully trusted, this restriction
+  can be removed with the new img_allowed_formats setup option.
+  See <https://ikiwiki.info/ikiwiki/directive/img/>
+  or <file:///usr/share/doc/ikiwiki/html/ikiwiki/directive/img.html> for
+  more details.
+
+ -- Simon McVittie <smcv@debian.org>  Fri, 06 May 2016 07:49:56 +0100
+
+ikiwiki (3.20150610) unstable; urgency=low
+
+  The new "emailauth" plugin allows users to authenticate using an email
+  address, without otherwise creating an account.
+
+  The openid plugin now enables emailauth by default. Please include
+  emailauth in the disable_plugins setting if this is not desired.
+  Conversely, if emailauth is required on a wiki that does not enable
+  openid, you can list it in the enable_plugins setting.
+
+ -- Simon McVittie <smcv@debian.org>  Wed, 10 Jun 2015 21:56:56 +0100
+
 ikiwiki (3.20150107) experimental; urgency=medium
 
   By default, this version of IkiWiki tells mobile browsers that its
@@ -111,7 +147,7 @@ ikiwiki (3.13) unstable; urgency=low
 
   The `ikiwiki-transition deduplinks` command introduced in the
   last release was buggy. If you followed the NEWS file instructions
-  and ran it, you should run `ikiwiki -setup` to rebuild your wiki
+  and ran it, you should run `ikiwiki --setup` to rebuild your wiki
   to fix the problem.
 
  -- Joey Hess <joeyh@debian.org>  Fri, 22 May 2009 13:04:02 -0400
@@ -209,7 +245,7 @@ ikiwiki (2.49) unstable; urgency=low
   Also, wikis that use the search plugin will need to be rebuilt,
   since the search form has changed. This will not be done automatically,
   but can be done by running `ikiwiki-mass-upgrade` as root, or
-  running `ikiwiki -setup` on individual setup files.
+  running `ikiwiki --setup` on individual setup files.
 
  -- Joey Hess <joeyh@debian.org>  Wed, 04 Jun 2008 00:29:28 -0400