Merge branch 'list_safety'

(gnutls fixes had updated some text docs)

diff --combined doc/doc-docbook/spec.xfpt
index 51c9b8bab8b65c4578fac6ddceb3dc33f57e1715,128329ef2d792b35c36034f6e891e134070381a9..81f69afaba28dc76199f69f598ac64375a1d9527
--- 1/doc/doc-docbook/spec.xfpt
--- 2/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@@ -10079,6 -10079,25 +10079,25 @@@ string is lexically greater than the se
  includes the case of letters, whereas for &%gti%& the comparison is
  case-independent.
  
+ .new
+ .vitem &*inlist&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*& &&&
+        &*inlisti&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*&
+ .cindex "string" "comparison"
+ .cindex "list" "iterative conditions"
+ Both strings are expanded; the second string is treated as a list of simple
+ strings; if the first string is a member of the second, then the condition
+ is true.
+ 
+ These are simpler to use versions of the more powerful &*forany*& condition.
+ Examples, and the &*forany*& equivalents:
+ .code
+ ${if inlist{needle}{foo:needle:bar}}
+   ${if forany{foo:needle:bar}{eq{$item}{needle}}}
+ ${if inlisti{Needle}{fOo:NeeDLE:bAr}}
+   ${if forany{fOo:NeeDLE:bAr}{eqi{$item}{Needle}}}
+ .endd
+ .wen
+ 
  .vitem &*isip&~{*&<&'string'&>&*}*&  &&&
         &*isip4&~{*&<&'string'&>&*}*& &&&
         &*isip6&~{*&<&'string'&>&*}*&
@@@ -10265,6 -10284,11 +10284,11 @@@ item can be used, as in all address lis
  have their local parts matched casefully. Domains are always matched
  caselessly.
  
+ .new
+ Note that <&'string2'&> is not itself subject to string expansion, unless
+ Exim was built with the EXPAND_LISTMATCH_RHS option.
+ .wen
+ 
  &*Note*&: Host lists are &'not'& supported in this way. This is because
  hosts have two identities: a name and an IP address, and it is not clear
  how to specify cleanly how such a test would work. However, IP addresses can be
@@@ -24595,14 -24619,8 +24619,14 @@@ DHE_DSS). The default list contains RSA
  For &%gnutls_require_mac%&, the recognized names are SHA (synonym SHA1), and
  MD5. The default list contains SHA, MD5.
  
 -For &%gnutls_require_protocols%&, the recognized names are TLS1 and SSL3.
 -The default list contains TLS1, SSL3.
 +.new
 +For &%gnutls_require_protocols%&, the recognized names are TLS1.2, TLS1.1,
 +TLS1.0, (TLS1) and SSL3.
 +The default list contains TLS1.2, TLS1.1, TLS1.0, SSL3.
 +TLS1 is an alias for TLS1.0, for backwards compatibility.
 +For sufficiently old versions of the GnuTLS library, TLS1.2 or TLS1.1 might
 +not be supported and will not be recognised by Exim.
 +.wen
  
  In a server, the order of items in these lists is unimportant. The server
  advertises the availability of all the relevant cipher suites. However, in a

diff --combined doc/doc-txt/ChangeLog
index e58136040aa5a68ee49453dc91ae0e6a89b047f6,e2e95c54827213f0aca9b2b2e0ae78f9f48718d3..a911d80a1f3e849a07ddca9f8336c0f8bbc46411
--- 1/doc/doc-txt/ChangeLog
--- 2/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@@ -112,11 -112,10 +112,15 @@@ PP/08 Handle ${run} returning more dat
  PP/09 Handle IPv6 addresses with SPF.
        Bugzilla 860.  Patch from Wolfgang Breyha.
  
 -PP/10 match_* no longer expand right-hand-side by default.
 +PP/10 GnuTLS: support TLS 1.2 & 1.1.
 +      Bugzilla 1156.
 +      Use gnutls_certificate_verify_peers2() [patch from Andreas Metzler].
 +      Bugzilla 1095.
 +
++PP/11 match_* no longer expand right-hand-side by default.
+       New compile-time build option, EXPAND_LISTMATCH_RHS.
+       New expansion conditions, "inlist", "inlisti".
+ 
  
  Exim version 4.76
  -----------------

diff --combined src/README.UPDATING
index fadf59aa9f5fc8f48bb40eb7abaa99b03ea992d8,20313b2cbdd9e44bc85030dfb61ea816c9e82daa..8a0533b102137bccb9d14eb082e2eacbb60febe3
--- 1/src/README.UPDATING
--- 2/src/README.UPDATING
+++ b/src/README.UPDATING
@@@ -29,12 -29,13 +29,19 @@@ that might affect a running system
  Exim version 4.77
  -----------------
  
 + * GnuTLS will now attempt to use TLS 1.2 and TLS 1.1 before TLS 1.0 and SSL3,
 +   if supported by your GnuTLS library.  Use the existing
 +   "gnutls_require_protocols" option to downgrade this if that will be a
 +   problem.  Prior to this release, supported values were "TLS1" and "SSL3",
 +   so you should be able to update configuration prior to update.
 +
+  * The match_<type>{string1}{string2} expansion conditions no longer subject
+    string2 to string expansion, unless Exim was built with the new
+    "EXPAND_LISTMATCH_RHS" option.  Too many people have inadvertently created
+    insecure configurations that way.  If you need the functionality and turn on
+    that build option, please let the developers know, and know why, so we can
+    try to provide a safer mechanism for you.
+ 
  
  Exim version 4.74
  -----------------