Merge branch 'list_safety'

(gnutls fixes had updated some text docs)

diff --cc doc/doc-docbook/spec.xfpt
Simple merge

diff --cc doc/doc-txt/ChangeLog
index e58136040aa5a68ee49453dc91ae0e6a89b047f6,e2e95c54827213f0aca9b2b2e0ae78f9f48718d3..a911d80a1f3e849a07ddca9f8336c0f8bbc46411
--- 1/doc/doc-txt/ChangeLog
--- 2/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@@ -112,11 -112,10 +112,15 @@@ PP/08 Handle ${run} returning more dat
  PP/09 Handle IPv6 addresses with SPF.
        Bugzilla 860.  Patch from Wolfgang Breyha.
  
 -PP/10 match_* no longer expand right-hand-side by default.
 +PP/10 GnuTLS: support TLS 1.2 & 1.1.
 +      Bugzilla 1156.
 +      Use gnutls_certificate_verify_peers2() [patch from Andreas Metzler].
 +      Bugzilla 1095.
 +
++PP/11 match_* no longer expand right-hand-side by default.
+       New compile-time build option, EXPAND_LISTMATCH_RHS.
+       New expansion conditions, "inlist", "inlisti".
+ 
  
  Exim version 4.76
  -----------------

diff --cc src/README.UPDATING
index fadf59aa9f5fc8f48bb40eb7abaa99b03ea992d8,20313b2cbdd9e44bc85030dfb61ea816c9e82daa..8a0533b102137bccb9d14eb082e2eacbb60febe3
--- 1/src/README.UPDATING
--- 2/src/README.UPDATING
+++ b/src/README.UPDATING
@@@ -29,12 -29,13 +29,19 @@@ that might affect a running system
  Exim version 4.77
  -----------------
  
 + * GnuTLS will now attempt to use TLS 1.2 and TLS 1.1 before TLS 1.0 and SSL3,
 +   if supported by your GnuTLS library.  Use the existing
 +   "gnutls_require_protocols" option to downgrade this if that will be a
 +   problem.  Prior to this release, supported values were "TLS1" and "SSL3",
 +   so you should be able to update configuration prior to update.
 +
+  * The match_<type>{string1}{string2} expansion conditions no longer subject
+    string2 to string expansion, unless Exim was built with the new
+    "EXPAND_LISTMATCH_RHS" option.  Too many people have inadvertently created
+    insecure configurations that way.  If you need the functionality and turn on
+    that build option, please let the developers know, and know why, so we can
+    try to provide a safer mechanism for you.
+ 
  
  Exim version 4.74
  -----------------