X-Git-Url: https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd-alex.git;a=blobdiff_plain;f=NEWS;h=a8dc433e57ffd3d8f84b9df26eafd94e54628b99;hp=420c1d873a4e0728a76d02e9b02458ef44bb7051;hb=849f85a05c17828c592bed26bd99707f211fad1c;hpb=11240376a5008dea9e970f40df659931d1321e8b

diff --git a/NEWS b/NEWS
index 420c1d87..a8dc433e 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,19 @@
 
 ngIRCd 21
 
+  - Implement a new configuration option "AllowedChannelTypes" that lists
+    all allowed channel types (channel prefixes) for newly created channels
+    on the local server. By default, all supported channel types are allowed.
+    If set to the empty string, local clients can't create new channels at
+    all, which equals the old "PredefChannelsOnly = yes" setting.
+    This change deprecates the "PredefChannelsOnly" variable, too, but it is
+    still supported and translated to the apropriate "AllowedChannelTypes"
+    setting. When the old "PredefChannelsOnly" variable is processed, a
+    warning message is logged. (Closes bug #152)
+  - Add support for "client certificate fingerprinting". When a client
+    passes an SSL certificate to the server, the "fingerprint" will be
+    forwarded in the network which enables IRC services to identify the
+    user using this certificate and not using passwords.
   - Implement a new configuration option "IncludeDir" in the "[Options]"
     section that can be used to specify a directory which can contain
     further configuration files and configuration file snippets matching
@@ -52,6 +65,14 @@ ngIRCd 21
     and then is used to output individual help texts to specific topics.
     Please see the file ./doc/Commands.txt for details.
 
+ngIRCd 20.3 (2013-08-23)
+
+  - This release is a bugfix release only, without new features.
+  - Security: Fix a denial of service bug (server crash) which could happen
+    when the configuration option "NoticeAuth" is enabled (which is NOT the
+    default) and ngIRCd failed to send the "notice auth" messages to new
+    clients connecting to the server (CVE-2013-5580).
+
 ngIRCd 20.2 (2013-02-15)
 
   - This release is a bugfix release only, without new features.