more on the security hole

diff --git a/doc/news/version_2.48.mdwn b/doc/news/version_2.48.mdwn
index c5e0e830dc5a9d6903b1670c6d47ea97cc9d0315..d78b42c54aba4f1b54e438c9ae7bc20534da016c 100644 (file)
--- a/doc/news/version_2.48.mdwn
+++ b/doc/news/version_2.48.mdwn
@@ -1,3 +1,5 @@
+**This release fixes an important security hole, upgrade immediately.**
+

 News for ikiwiki 2.48:
 
    If you allowed password based logins to your wiki, those passwords were
 News for ikiwiki 2.48:
 
    If you allowed password based logins to your wiki, those passwords were


@@ -21,4 +23,4 @@ ikiwiki 2.48 released with [[toggle text="these changes"]]
    * The password\_cost config setting is provided as a "more security" knob.
    * teximg: Fix logurl.
    * teximg: If the log isn't written, avoid ugly error messages.
    * The password\_cost config setting is provided as a "more security" knob.
    * teximg: Fix logurl.
    * teximg: If the log isn't written, avoid ugly error messages.

-   * Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]]
\ No newline at end of file
+   * Updated French translation. Closes: #[478530](http://bugs.debian.org/478530)"""]]

diff --git a/doc/security.mdwn b/doc/security.mdwn
index b3af3db3e1a3d013acb699f0f866b3a6c5d9538f..ea8954f5c234bf771483372c9763c9adb75160f8 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -397,3 +397,13 @@ with strong blowfish hashes.
 You might also consider changing to [[plugins/openid]], which does not 
 require ikiwiki deal with passwords at all, and does not involve users sending
 passwords in cleartext over the net to log in, either.
 You might also consider changing to [[plugins/openid]], which does not 
 require ikiwiki deal with passwords at all, and does not involve users sending
 passwords in cleartext over the net to log in, either.

+
+## Empty password security hole
+
+This hole allowed ikiwiki to accept logins using empty passwords, to openid
+accounts that didn't use a password. It was introduced in version 1.34, and
+fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
+discovered on 30 May 2008 and fixed the same day.
+
+I recommend upgrading to 2.48 immediatly if your wiki allows both password
+and openid logins.