Add new config-option 'migrate_passwords' in section 'web' to

[roundup.git] / CHANGES.txt

diff --git a/CHANGES.txt b/CHANGES.txt
index 8e167541bd84a7a71e30ed1f3e1967fb710927f2..4fe82cfcbe7d2afca9d908983087054c920534d1 100644 (file)
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -79,6 +79,11 @@ Fixed:
 - Fix Password handling security issue2550688 (thanks Joseph Myers for
   reporting and Eli Collins for fixing) -- this fixes all observations
   by Joseph Myers except for auto-migration of existing passwords.
+- Add new config-option 'migrate_passwords' in section 'web' to
+  auto-migrate passwords at web-login time. Default for the new option
+  is "yes" so if you don't want that passwords are auto-migrated to a
+  more secure password scheme on user login, set this to "no" before
+  running your tracker(s) after the upgrade.
 
 2010-10-08 1.4.16 (r4541)