From: Joey Hess Date: Wed, 2 Jul 2008 20:47:29 +0000 (-0400) Subject: update X-Git-Tag: 2.52~12 X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/commitdiff_plain/f8e33430d85bd30f37f723c0b9ed6ef57e140603?ds=inline update --- diff --git a/doc/security.mdwn b/doc/security.mdwn index 57cac719f..52ef486e6 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -41,11 +41,12 @@ who's viewing the wiki, that can be a security problem. Of course nobody else seems to worry about this in other wikis, so should we? -Currently only people with direct commit access can upload such files +People with direct commit access can upload such files (and if you wanted to you could block that with a pre-commit hook). -Users with only web commit access are limited to editing pages as ikiwiki -doesn't support file uploads from browsers (yet), so they can't exploit -this. + +The attachments plugin is not enabled by default. If you choose to +enable it, you should make use of its powerful abilities to filter allowed +types of attachments, and only let trusted users upload. It is possible to embed an image in a page edited over the web, by using `img src="data:image/png;"`. Ikiwiki's htmlscrubber only allows `data:`