diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7fdbe28eb9..c67bfb8f36 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,14 @@
+Changes in [0.7.2](https://github.com/matrix-org/matrix-react-sdk/releases/tag/v0.7.2) (2016-09-21)
+===================================================================================================
+[Full Changelog](https://github.com/matrix-org/matrix-react-sdk/compare/v0.7.1...v0.7.2)
+
+ * Revert #333
+   [\#491](https://github.com/matrix-org/matrix-react-sdk/pull/491)
+ * EncryptedEventDialog updates
+   [\#490](https://github.com/matrix-org/matrix-react-sdk/pull/490)
+ * Apply heuristic on incoming DMs
+   [\#487](https://github.com/matrix-org/matrix-react-sdk/pull/487)
+
 Changes in [0.7.1](https://github.com/matrix-org/matrix-react-sdk/releases/tag/v0.7.1) (2016-09-21)
 ===================================================================================================
  * Correct js-sdk version dependency
diff --git a/package.json b/package.json
index b30307eec0..892fbecdf8 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "matrix-react-sdk",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "SDK for matrix.org using React",
   "author": "matrix.org",
   "repository": {
diff --git a/src/HtmlUtils.js b/src/HtmlUtils.js
index 63445dcf30..01ae50cf68 100644
--- a/src/HtmlUtils.js
+++ b/src/HtmlUtils.js
@@ -87,7 +87,7 @@ var sanitizeHtmlParams = {
         // deliberately no h1/h2 to stop people shouting.
         'h3', 'h4', 'h5', 'h6', 'blockquote', 'p', 'a', 'ul', 'ol',
         'nl', 'li', 'b', 'i', 'u', 'strong', 'em', 'strike', 'code', 'hr', 'br', 'div',
-        'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre', 'img',
+        'table', 'thead', 'caption', 'tbody', 'tr', 'th', 'td', 'pre'
     ],
     allowedAttributes: {
         // custom ones first:
@@ -101,9 +101,11 @@ var sanitizeHtmlParams = {
     selfClosing: [ 'img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta' ],
     // URL schemes we permit
     allowedSchemes: [ 'http', 'https', 'ftp', 'mailto' ],
-    allowedSchemesByTag: {
-        img: [ 'data' ],
-    },
+
+    // DO NOT USE. sanitize-html allows all URL starting with '//'
+    // so this will always allow links to whatever scheme the
+    // host page is served over.
+    allowedSchemesByTag: {},
 
     transformTags: { // custom to matrix
         // add blank targets to all hyperlinks except vector URLs