diff --git a/CHANGES.txt b/CHANGES.txt
index 142d8ae36dc26f3e123ea16f9487945468d2df8d..4fe82cfcbe7d2afca9d908983087054c920534d1 100644 (file)
--- a/CHANGES.txt
+++ b/CHANGES.txt
Features:
+- Allow declaration of default_values for properties in schema.
- Add explicit "Search" permissions, see Security Fix below.
- Add "lookup" method to xmlrpc interface (Ralf Schlatterbeck)
- Multilinks can be filtered by combining elements with AND, OR and NOT
(Ralf Schlatterbeck)
- Fixed bug in mailgw refactoring, patch issue2550697 (thanks Hubert
Touvet)
-- Fix first part of Password handling security issue2550688 (thanks
- Joseph Myers for reporting and Eli Collins for fixing)
+- Fix Password handling security issue2550688 (thanks Joseph Myers for
+ reporting and Eli Collins for fixing) -- this fixes all observations
+ by Joseph Myers except for auto-migration of existing passwords.
+- Add new config-option 'migrate_passwords' in section 'web' to
+ auto-migrate passwords at web-login time. Default for the new option
+ is "yes" so if you don't want that passwords are auto-migrated to a
+ more secure password scheme on user login, set this to "no" before
+ running your tracker(s) after the upgrade.
2010-10-08 1.4.16 (r4541)