Added v21.11.2 notice to updates page

diff --git a/content/blog/security-release-v21-11-2.md b/content/blog/security-release-v21-11-2.md
index bc2ed8a0a670032c248a2093b1182194db9487b1..85ec60a968e8f435559e0c303a5164c8af1e7087 100644 (file)
--- a/content/blog/security-release-v21-11-2.md
+++ b/content/blog/security-release-v21-11-2.md
@@ -13,7 +13,7 @@ BookStack v21.11.2 has been released.
 This is a security release that address a couple of vulnerabilities relating to API access
 and page draft related content visibility:
 
-- If the "Public" role was provided API access then the API could be accessed, in certain scenarios
+- If the "Public" role was provided API access then the API could be accessed, in certain scenarios,
   by non-authenticated users even if the "Allow public access" setting was disabled.
 - In some specific scenarios, content related to page drafts (Such as attachments) could be visible
   to non-owners (Whom would have permission to view the page if saved  as a non-draft at that point).

diff --git a/content/docs/admin/updates.md b/content/docs/admin/updates.md
index ee81a481b79e0a80246075cbba2ce73010fbbea5..20f754f40112c8997e9d530535a14b41113b9472 100644 (file)
--- a/content/docs/admin/updates.md
+++ b/content/docs/admin/updates.md
@@ -38,6 +38,14 @@ Details of updates can be found on [our blog](https://www.bookstackapp.com/blog/
 the [GitHub releases page](https://github.com/BookStackApp/BookStack/releases).
 
 
+#### Updating to v21.11.2 or higher
+
+**Security** - v21.11.2 addresses a couple of vulnerabilities relating to API access
+and page draft related content visibility. If the "Public" role was provided API access then the API could
+be accessed, in certain scenarios, by non-authenticated users even if the "Allow public access" setting was disabled.
+In some specific scenarios, content related to page drafts (Such as attachments) could be visible to non-owners 
+(Whom would have permission to view the page if saved  as a non-draft at that point).
+
 #### Updating to v21.11 or higher
 
 **API Changes** - As of v21.11 any dates in API responses will be formatted as per ISO-8601, with `2019-12-02T20:01:00.283041Z` reflecting an example of this format. You may need to review any of your scripts that utilise dates from API responses.