web commit by joey

[ikiwiki.git] / doc / security.mdwn

diff --git a/doc/security.mdwn b/doc/security.mdwn
index 0731ff3c5794cfe7b16f64286e1481c3d74ac836..c5d4256064204e9f0f15ab558de07a5ee54ea3a4 100644 (file)
--- a/doc/security.mdwn
+++ b/doc/security.mdwn
@@ -84,7 +84,7 @@ been no problem yet.
 
 ikiwiki does not expose untrusted data to the shell. In fact it doesn't use
 system() at all, and the only use of backticks is on data supplied by the
-wiki admin. And it runs with taint checks on of course..
+wiki admin and untainted filenames. And it runs with taint checks on of course..
 
 ## cgi data security
 
@@ -109,7 +109,9 @@ Login to the wiki involves sending a password in cleartext over the net.
 Cracking the password only allows editing the wiki as that user though.
 If you care, you can use https, I suppose.
 
-# Fixed holes.
+# Fixed holes
+
+_(Unless otherwise noted, these were discovered and immediaty fixed by the ikiwiki developers)_
 
 ## destination directory file replacement