From f8e33430d85bd30f37f723c0b9ed6ef57e140603 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Wed, 2 Jul 2008 16:47:29 -0400 Subject: [PATCH 1/1] update --- doc/security.mdwn | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/doc/security.mdwn b/doc/security.mdwn index 57cac719f..52ef486e6 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -41,11 +41,12 @@ who's viewing the wiki, that can be a security problem. Of course nobody else seems to worry about this in other wikis, so should we? -Currently only people with direct commit access can upload such files +People with direct commit access can upload such files (and if you wanted to you could block that with a pre-commit hook). -Users with only web commit access are limited to editing pages as ikiwiki -doesn't support file uploads from browsers (yet), so they can't exploit -this. + +The attachments plugin is not enabled by default. If you choose to +enable it, you should make use of its powerful abilities to filter allowed +types of attachments, and only let trusted users upload. It is possible to embed an image in a page edited over the web, by using `img src="data:image/png;"`. Ikiwiki's htmlscrubber only allows `data:` -- 2.44.0