more on the security hole

diff --git a/doc/news/version_2.48.mdwn b/doc/news/version_2.48.mdwn
index c5e0e830dc5a9d6903b1670c6d47ea97cc9d0315..d78b42c54aba4f1b54e438c9ae7bc20534da016c 100644 (file)
--- a/doc/news/version_2.48.mdwn
+++ b/doc/news/version_2.48.mdwn
@@ -1,3 +1,5 @@
+**This release fixes an important security hole, upgrade immediately.**
+
 News for ikiwiki 2.48:
 
    If you allowed password based logins to your wiki, those passwords were
@@ -21,4 +23,4 @@ ikiwiki 2.48 released with [[toggle text="these changes"]]
    * The password\_cost config setting is provided as a "more security" knob.
    * teximg: Fix logurl.
    * teximg: If the log isn't written, avoid ugly error messages.
-   * Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]]
\ No newline at end of file
+   * Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]]

diff --git a/doc/security.mdwn b/doc/security.mdwn
index b3af3db3e1a3d013acb699f0f866b3a6c5d9538f..ea8954f5c234bf771483372c9763c9adb75160f8 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -397,3 +397,13 @@ with strong blowfish hashes.
 You might also consider changing to [[plugins/openid]], which does not 
 require ikiwiki deal with passwords at all, and does not involve users sending
 passwords in cleartext over the net to log in, either.
+
+## Empty password security hole
+
+This hole allowed ikiwiki to accept logins using empty passwords, to openid
+accounts that didn't use a password. It was introduced in version 1.34, and
+fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
+discovered on 30 May 2008 and fixed the same day.
+
+I recommend upgrading to 2.48 immediatly if your wiki allows both password
+and openid logins.