diff options
| author | Joey Hess <joey@kodama.kitenet.net> | 2008-07-02 16:47:29 -0400 |
|---|---|---|
| committer | Joey Hess <joey@kodama.kitenet.net> | 2008-07-02 16:47:29 -0400 |
| commit | f8e33430d85bd30f37f723c0b9ed6ef57e140603 (patch) | |
| tree | f86fff5b58f2abc4c8fc227e7ccc5c852c991bdd | |
| parent | 2354613391996b89f16d5a67c15324307a6c0d04 (diff) | |
update
| -rw-r--r-- | doc/security.mdwn | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/doc/security.mdwn b/doc/security.mdwn index 57cac719f..52ef486e6 100644 --- a/doc/security.mdwn +++ b/doc/security.mdwn @@ -41,11 +41,12 @@ who's viewing the wiki, that can be a security problem. Of course nobody else seems to worry about this in other wikis, so should we? -Currently only people with direct commit access can upload such files +People with direct commit access can upload such files (and if you wanted to you could block that with a pre-commit hook). -Users with only web commit access are limited to editing pages as ikiwiki -doesn't support file uploads from browsers (yet), so they can't exploit -this. + +The attachments plugin is not enabled by default. If you choose to +enable it, you should make use of its powerful abilities to filter allowed +types of attachments, and only let trusted users upload. It is possible to embed an image in a page edited over the web, by using `img src="data:image/png;"`. Ikiwiki's htmlscrubber only allows `data:` |