=================================
Review Board 1.6.18 Release Notes
=================================

**Release date**: July 28, 2013


Security Fixes
==============

This release contains security updates to better lock down Review Board
from malicious users.

There are no known vulnerabilities in the wild for these issues, but we
recommend upgrading immediately.

* Function names in diff headers are no longer rendered as HTML.
  Patch by Damian Johnson. (:bug:`2612`)

* If the user's full name contained HTML, the Submitters list would render
  it as HTML, without escaping it. This was an XSS vulnerability.
  (:cve:`2013-4795`)

* The default Apache configuration is now more strict with how it serves
  up file attachments. This does not apply to older installations.
  To update your configuration, and to read best practices, read our
  guide on `securing file attachments`_.

* Uploaded files are now renamed to include a hash, preventing users from
  uploading malicious filenames, and making filenames unguessable.

* Recaptcha support has been updated to use the new URLs provided by Google.
  This re-enables Recaptcha support when serving over HTTPS.


.. _`securing file attachments`:
   http://support.beanbaginc.com/support/solutions/articles/110173-securing-file-attachments


Contributors
============

* Christian Hammond
* Damian Johnson
