improve policy description

ImageMagick · Aug 27, 2023 · 06e3ecf · 06e3ecf
1 parent b0664d5
commit 06e3ecf
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 5 deletions.
diff --git a/config/limited-policy.xml b/config/limited-policy.xml
@@ -73,7 +73,7 @@
   <!-- Ensure all image data is fully flushed and synchronized to disk. -->
   <!-- <policy domain="cache" name="synchronize" value="true"/> -->
   <!-- Replace passphrase for secure distributed processing -->
-  <!-- <policy domain="cache" name="shared-secret" value="my-secret-passphrase" stealth="true"/> -->
+  <!-- <policy domain="cache" name="shared-secret" value="secret-passphrase" stealth="true"/> -->
   <!-- Do not permit any delegates to execute. -->
   <!-- <policy domain="delegate" rights="none" pattern="*"/> -->
   <!-- Do not permit any image filters to load. -->

diff --git a/config/open-policy.xml b/config/open-policy.xml
@@ -128,7 +128,7 @@
   <!-- Ensure all image data is fully flushed and synchronized to disk. -->
   <!-- <policy domain="cache" name="synchronize" value="true"/> -->
   <!-- Replace passphrase for secure distributed processing -->
-  <!-- <policy domain="cache" name="shared-secret" value="my-secret-passphrase" stealth="true"/> -->
+  <!-- <policy domain="cache" name="shared-secret" value="secret-passphrase" stealth="true"/> -->
   <!-- Do not permit any delegates to execute. -->
   <!-- <policy domain="delegate" rights="none" pattern="*"/> -->
   <!-- Do not permit any image filters to load. -->

diff --git a/config/secure-policy.xml b/config/secure-policy.xml
@@ -81,7 +81,7 @@
   <!-- Ensure all image data is fully flushed and synchronized to disk. -->
   <policy domain="cache" name="synchronize" value="true"/>
   <!-- Replace passphrase for secure distributed processing -->
-  <!-- <policy domain="cache" name="shared-secret" value="my-secret-passphrase" stealth="true"/> -->
+  <!-- <policy domain="cache" name="shared-secret" value="secret-passphrase" stealth="true"/> -->
   <!-- Do not permit any delegates to execute. -->
   <policy domain="delegate" rights="none" pattern="*"/>
   <!-- Do not permit any image filters to load. -->

diff --git a/config/websafe-policy.xml b/config/websafe-policy.xml
@@ -77,7 +77,7 @@
   <!-- Ensure all image data is fully flushed and synchronized to disk. -->
   <policy domain="cache" name="synchronize" value="true"/>
   <!-- Replace passphrase for secure distributed processing -->
-  <!-- <policy domain="cache" name="shared-secret" value="my-secret-passphrase" stealth="true"/> -->
+  <!-- <policy domain="cache" name="shared-secret" value="secret-passphrase" stealth="true"/> -->
   <!-- Do not permit any delegates to execute. -->
   <policy domain="delegate" rights="none" pattern="*"/>
   <!-- Do not permit any image filters to load. -->
@@ -88,7 +88,8 @@
   <policy domain="path" rights="none" pattern="/etc/*"/>
   <!-- Indirect reads are not permitted. -->
   <policy domain="path" rights="none" pattern="@*"/>
-  <!-- Only allow reading or writing web-safe image formats. -->
+  <!-- Deny all image modules and specifically exempt reading or writing
+       web-safe image formats. -->
   <policy domain="module" rights="none" pattern="*" />
   <policy domain="module" rights="read | write" pattern="{GIF,JPEG,PNG,WEBP}" />
   <!-- This policy sets the number of times to replace content of certain