- Enhancement: Auto-detect allowedImageLibOrigins based on locale rather than requiring user to supply

2018-09-25 02:35:15 +08:00
parent a22895c53a
commit 7ff2721ba9
5 changed files with 30 additions and 30 deletions
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,8 +1,7 @@
 # ?

- Security fix/Breaking change (Imagelib): Require `allowedImageLibOrigins`
-  config array be set with safe origins or otherwise reject `postMessage`
-  messages in case from untrusted sources
+- Security fix/Breaking change (Imagelib): Only allow origins within
+  `imgLibs` to be accepted for `message` listener
 - Security fix/Breaking change (xdomain): Namespace xdomain file to avoid
  it being used to modify non-xdomain storage
 - Security fix (Imagelib): Avoid XSS