2016-05-06 21:10:19 +02:00
|
|
|
News for ikiwiki 3.20160506:
|
|
|
|
|
|
|
|
|
|
To mitigate [[!cve CVE-2016-3714]] and similar ImageMagick security vulnerabilities,
|
2016-05-06 21:14:09 +02:00
|
|
|
the `\[[!img]]` directive is now restricted to these common web formats by
|
2016-05-06 21:10:19 +02:00
|
|
|
default:
|
2016-05-06 21:14:09 +02:00
|
|
|
|
2016-05-06 21:10:19 +02:00
|
|
|
* JPEG (`.jpg`, `.jpeg`)
|
|
|
|
|
* PNG (`.png`)
|
|
|
|
|
* GIF (`.gif`)
|
|
|
|
|
* SVG (`.svg`)
|
2016-05-06 21:14:09 +02:00
|
|
|
|
2016-05-06 21:10:19 +02:00
|
|
|
(In particular, by default resizing PDF files is no longer allowed.)
|
2016-05-06 21:14:09 +02:00
|
|
|
|
2016-05-06 21:10:19 +02:00
|
|
|
Additionally, resized SVG files are displayed in the browser as SVG
|
|
|
|
|
instead of being converted to PNG.
|
2016-05-06 21:14:09 +02:00
|
|
|
|
2016-05-06 21:10:19 +02:00
|
|
|
If all users who can attach images are fully trusted, this restriction
|
|
|
|
|
can be removed with the new img\_allowed\_formats setup option.
|
|
|
|
|
See [[ikiwiki/directive/img]] for more details.
|
|
|
|
|
|
|
|
|
|
ikiwiki 3.20160506 released with [[!toggle text="these changes"]]
|
|
|
|
|
[[!toggleable text="""
|
|
|
|
|
* [ [[Simon McVittie|smcv]] ]
|
|
|
|
|
* HTML-escape error messages, in one case avoiding potential cross-site
|
2016-05-06 22:35:14 +02:00
|
|
|
scripting ([[!cve CVE-2016-4561]], OVE-20160505-0012)
|
2016-05-06 21:10:19 +02:00
|
|
|
* Mitigate ImageMagick vulnerabilities such as CVE-2016-3714:
|
|
|
|
|
- img: force common Web formats to be interpreted according to extension,
|
|
|
|
|
so that "allowed\_attachments: '*.jpg'" does what one might expect
|
|
|
|
|
- img: restrict to JPEG, PNG and GIF images by default, again mitigating
|
|
|
|
|
CVE-2016-3714 and similar vulnerabilities
|
|
|
|
|
- img: check that the magic number matches what we would expect from
|
|
|
|
|
the extension before giving common formats to ImageMagick
|
|
|
|
|
* d/control: use https for Homepage
|
|
|
|
|
* d/control: add Vcs-Browser
|
|
|
|
|
* [ [[Joey Hess|joey]] ]
|
|
|
|
|
* img: Add back support for SVG images, bypassing ImageMagick and
|
|
|
|
|
simply passing the SVG through to the browser, which is supported by all
|
|
|
|
|
commonly used browsers these days.
|
|
|
|
|
SVG scaling by img directives has subtly changed; where before
|
|
|
|
|
size=wxh would preserve aspect ratio, this cannot be done when passing
|
|
|
|
|
them through and so specifying both a width and height can change
|
|
|
|
|
the SVG's aspect ratio.
|
|
|
|
|
* loginselector: When only openid and emailauth are enabled, but
|
|
|
|
|
passwordauth is not, avoid showing a "Other" box which opens an
|
|
|
|
|
empty form.
|
|
|
|
|
* [ [[Amitai Schlair|schmonz]] ]
|
|
|
|
|
* mdwn: Process .md like .mdwn, but disallow web creation.
|
|
|
|
|
* [ Florian Wagner ]
|
|
|
|
|
* git: Correctly handle filenames starting with a dash in add/rm/mv."""]]
|
