Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

much safer default, don't send sensitive information onto the internet #412

Merged
merged 1 commit into from
May 11, 2022

Conversation

manofstick
Copy link
Contributor

The changeset a47ac0e changed the default for plantuml to be a public internet site. This to me is a serious issue, because if one forgets to set a different configuration, then all potentially sensitive diagram will be flooded into the public internet.

Given that you can easily configure to use the public internet site with just a simply supplied config file such as:

Gollum::Filter::PlantUML.configure do |config|
    config.url = "http://www.plantuml.com/plantuml/png"
end

I would highly recommend that this PR be accepted, and that configuration be displayed on https://github.com/gollum/gollum/wiki/Custom-PlantUML-Server#configuring-a-plantuml-server

@dometto
Copy link
Member

dometto commented Jan 21, 2022

No objections and a fair point. Note that this would constitute a breaking change though, and I'm not sure how best to approach that: should we wait with releasing this until we release a breaking change of gollum?

@manofstick
Copy link
Contributor Author

@dometto I'm have no comment on feature/release planning, so whatever you think is appropriate.

@dometto
Copy link
Member

dometto commented May 10, 2022

Still wondering what's best from a release point of view. Any thoughts @bartkamphorst?

@bartkamphorst
Copy link
Member

I agree with the change, but suggest to make it once we are ready to bump to 6.x.

@dometto dometto changed the base branch from master to 6.x May 11, 2022 09:06
@dometto
Copy link
Member

dometto commented May 11, 2022

Merging this into the 6.x branch

@dometto dometto merged commit 813bf28 into gollum:6.x May 11, 2022
dometto pushed a commit to repotag/gollum-lib that referenced this pull request Sep 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants