Mention the latest changes.

[rsync/rsync.git] / NEWS

diff --git a/NEWS b/NEWS
index 290c72d..e09426f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,10 +5,11 @@ Changes since 2.6.2:
   SECURITY FIXES:
 
     - A bug in the sanitize_path routine (which affects a non-chrooted
-      rsync daemon) could allow a user to specify an absolute path for
-      certain options (but not for file-transfer names).  If you're running
-      a rsync daemon with chroot disabled, *please upgrade*, ESPECIALLY if
-      the user privs you run rsync under is anything above "nobody".
+      rsync daemon) could allow a user to craft a pathname that would get
+      transformed into an absolute path for certain options (but not for
+      file-transfer names).  If you're running an rsync daemon with chroot
+      disabled, *please upgrade*, ESPECIALLY if the user privs you run
+      rsync under is anything above "nobody".
 
   OUTPUT CHANGES (ATTN: those using a script to parse the verbose output):
 
@@ -150,7 +151,7 @@ Changes since 2.6.2:
       systems), and is much less intrusive into the code (making it easier
       to maintain for the future).  The new code generates just one data
       file instead of three, which makes it possible to read the batch via
-      stdin over a remote shell.  Also, the old requirement of forcing the
+      stdin via a remote shell.  Also, the old requirement of forcing the
       same fixed checksum-seed for all batch processing has been removed.
 
     - If an rsync daemon has a module set with "list = no" (which hides its
@@ -163,8 +164,16 @@ Changes since 2.6.2:
     - The daemon's "refuse options" config item now allows you to match
       option names using wildcards and/or the single-letter option names.
 
-    - The finished file now gets its permissions and modified-time updated
-      before it gets moved into place.
+    - Each transferred file now gets its permissions and modified-time
+      updated before the temp-file gets moved into place.  Previously, the
+      finished file would have a very brief window where its permissions
+      disallowed all group and world access.
+
+    - Support for literal IPv6 addresses was added to the URL parser for the
+      "rsync:" scheme (e.g. rsync://[2001:638:500:101::21]:873/module/dir).
+
+    - Added the ability to parse a literal IPv6 address in an "rsync:" URL
+      (e.g. rsync://[2001:638:500:101::21]:873/module/dir).
 
   INTERNAL: