Improve the mailto_allow documentation.

Add to the commands list.  Document unmailto_allow.  Mention the new
behavior in the Security Considerations section about mailto: links.

diff --git a/doc/manual.xml.head b/doc/manual.xml.head
index 54c96a0e948fb75c93e27c8db7a0347ca524d26b..fe4978d52200d624a3477a18cd6b856657bb0148 100644 (file)
--- a/doc/manual.xml.head
+++ b/doc/manual.xml.head
@@ -4718,6 +4718,16 @@ set index_format="%4C %Z %{%b %d} %-15.15L (%?l?%4l&amp;%4c?)%*  %s"</screen>
 <replaceable class="parameter">header-field</replaceable>
 </arg>
 </group>
+
+<command>unmailto_allow</command>
+<group choice="req">
+<arg choice="plain">
+<replaceable class="parameter">*</replaceable>
+</arg>
+<arg choice="plain" rep="repeat">
+<replaceable class="parameter">header-field</replaceable>
+</arg>
+</group>
 </cmdsynopsis>
 
 <para>
@@ -4729,7 +4739,7 @@ commands allow the user to modify the list of approved headers.
 </para>
 <para>
 Mutt initializes the default list to contain only the <literal>Subject</literal>
-and <literal>body</literal> header fields, which are the only requirement specified
+and <literal>Body</literal> header fields, which are the only requirement specified
 by the <literal>mailto:</literal> specification in RFC2368.
 </para>
 </sect1>
@@ -8165,6 +8175,14 @@ will send out the user's private gnupg keyring to
 on screen carefully enough.
 </para>
 
+<para>
+To prevent these issues, Mutt by default only accepts the
+<literal>Subject</literal> and <literal>Body</literal> headers.
+Allowed headers can be adjusted with the
+<link linkend="mailto-allow"><command>mailto_allow</command></link> and
+<link linkend="mailto-allow"><command>unmailto_allow</command></link> commands.
+</para>
+
 </sect2>
 
 </sect1>
@@ -8945,6 +8963,30 @@ The following are the commands understood by Mutt:
 </cmdsynopsis>
 </listitem>
 
+<listitem>
+<cmdsynopsis>
+<command><link linkend="mailto-allow">mailto_allow</link></command>
+<group choice="req">
+<arg choice="plain">
+<replaceable class="parameter">*</replaceable>
+</arg>
+<arg choice="plain" rep="repeat">
+<replaceable class="parameter">header-field</replaceable>
+</arg>
+</group>
+
+<command><link linkend="mailto-allow">unmailto_allow</link></command>
+<group choice="req">
+<arg choice="plain">
+<replaceable class="parameter">*</replaceable>
+</arg>
+<arg choice="plain" rep="repeat">
+<replaceable class="parameter">header-field</replaceable>
+</arg>
+</group>
+</cmdsynopsis>
+</listitem>
+
 <listitem>
 <cmdsynopsis>
 <command><link linkend="mbox-hook">mbox-hook</link></command>