From: Joey Hess Date: Wed, 2 Jul 2008 20:47:29 +0000 (-0400) Subject: update X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/commitdiff_plain/f8e33430d85bd30f37f723c0b9ed6ef57e140603?hp=2354613391996b89f16d5a67c15324307a6c0d04 update --- diff --git a/doc/security.mdwn b/doc/security.mdwn index 57cac719f..52ef486e6 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -41,11 +41,12 @@ who's viewing the wiki, that can be a security problem. Of course nobody else seems to worry about this in other wikis, so should we? -Currently only people with direct commit access can upload such files +People with direct commit access can upload such files (and if you wanted to you could block that with a pre-commit hook). -Users with only web commit access are limited to editing pages as ikiwiki -doesn't support file uploads from browsers (yet), so they can't exploit -this. + +The attachments plugin is not enabled by default. If you choose to +enable it, you should make use of its powerful abilities to filter allowed +types of attachments, and only let trusted users upload. It is possible to embed an image in a page edited over the web, by using `img src="data:image/png;"`. Ikiwiki's htmlscrubber only allows `data:`