BREAKING CHANGE: block local filesystem access by default

fixes #4536

CHANGELOG.md

@@ -2,6 +2,7 @@ v0.12.6 (unreleased)
 --------------------
 * **#3953**: fix TOC and other special pages not present in output PDF (#3962)
 * **#3242**: **[qt]** fix regression from #2353 in setLineDash for Canvas (qt#35)
+* **#4536**: BREAKING CHANGE: block local filesystem access by default
 
 v0.12.5 (2018-06-11)
 --------------------

src/lib/loadsettings.cc

@@ -140,7 +140,7 @@ LoadPage::LoadPage():
 	windowStatus(""),
 	zoomFactor(1.0),
 	repeatCustomHeaders(false),
-	blockLocalFileAccess(false),
+	blockLocalFileAccess(true),
 	stopSlowScripts(true),
 	debugJavascript(false),
 	loadErrorHandling(abort),