X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/e16746a52f40f478af1b634c532d90c25cc0ec76..42ab1bf185dff5803b4cddf4b0b22c8d4ea5b90d:/doc/security.mdwn?ds=inline

diff --git a/doc/security.mdwn b/doc/security.mdwn
index fea0eb727..154566cd8 100644
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -18,7 +18,7 @@ _(The list of things to fix.)_
 
 Anyone with direct commit access can forge "web commit from foo" and
 make it appear on [[RecentChanges]] like foo committed. One way to avoid
-this would be to limit web commits to those done by a certian user.
+this would be to limit web commits to those done by a certain user.
 
 ## other stuff to look at
 
@@ -158,6 +158,20 @@ allowed, so that's not a problem.)
 
 ----
 
+# Plugins
+
+The security of [[plugins]] depends on how well they're written and what
+external tools they use. The plugins included in ikiwiki are all held to
+the same standards as the rest of ikiwiki, but with that said, here are
+some security notes for them.
+
+* The [[plugins/img]] plugin assumes that imagemagick/perlmagick are secure
+  from malformed image attacks. Imagemagick has had security holes in the
+  past. To be able to exploit such a hole, a user would need to be able to
+  upload images to the wiki.
+
+----
+
 # Fixed holes
 
 _(Unless otherwise noted, these were discovered and immediately fixed by the