Adds upgrade notes for #3528.

CHANGELOG.txt

@@ -60,6 +60,7 @@ Changelog
  * Fix: `RichTextBlock` toolbar now correctly positioned within `StructBlock` (Janneke Janssen)
  * Fix: Fixed display of ManyToMany fields and False values on the ModelAdmin inspect view (Andy Babic)
  * Fix: Prevent pages from being recursively copied into themselves (Matheus Bratfisch)
+ * Fix: Specifying the full file name in documents URL is mandatory (Morgan Aubert)
 
 
 1.9 (16.02.2017)

docs/releases/1.10.rst

@@ -75,6 +75,7 @@ Bug fixes
  * ``RichTextBlock`` toolbar now correctly positioned within ``StructBlock`` (Janneke Janssen)
  * Fixed display of ManyToMany fields and False values on the ModelAdmin inspect view (Andy Babic)
  * Prevent pages from being recursively copied into themselves (Matheus Bratfisch)
+ * Specifying the full file name in documents URL is mandatory (Morgan Aubert)
 
 
 Upgrade considerations
@@ -122,3 +123,19 @@ Adding / editing users through Wagtail admin no longer sets ``is_staff`` flag
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 Previously, the ``is_staff`` flag (which grants access to the Django admin interface) was automatically set for superusers, and reset for other users, when creating and updating users through the Wagtail admin. This behaviour has now been removed, since Wagtail is designed to work independently of the Django admin. If you need to reinstate the old behaviour, you can set up a `pre_save signal handler <https://docs.djangoproject.com/en/1.10/ref/signals/#django.db.models.signals.pre_save>`_ on the User model to set the flag appropriately.
+
+
+Specifying the full file name in documents URL is mandatory
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+In previous releases, it was possible to download a document using
+the primary key and a fraction of its file name, or even without file name.
+You could get the same document at the addresses
+``/documents/1/your-file-name.pdf``, ``/documents/1/you`` & ``/documents/1/``.
+
+This feature was supposed to allow shorter URLs but was not used in Wagtail.
+For security reasons, we removed it, so only the full URL works:
+``/documents/1/your-file-name.pdf``
+
+If any of your applications relied on the previous behaviour, you will have to
+rewrite it to take this into account.