view .hgignore @ 5523:38d1c99cd000 stable

login: enhance came_from validation Drop urlparse and just validate that came_from is a RFC 3986 compliant path. This blocks an HTTP header injection vulnerability discovered by Gjoko Krstic <gjoko@zeroscience.mk> of Zero Science Lab (CVE-2015-5285)
author Søren Løvborg <sorenl@unity3d.com>
date Wed, 23 Sep 2015 16:09:14 +0200
parents bfa66e8887d7
children 9358211ee144
line wrap: on
line source

syntax: glob
*.pyc
*.swp
*.sqlite
*.tox
*.egg-info
*.egg
*.mo
.eggs/
tarballcache/

syntax: regexp
^rcextensions
^build
^dist/
^docs/build/
^docs/_build/
^data$
^kallithea/tests/data$
^sql_dumps/
^\.settings$
^\.project$
^\.pydevproject$
^\.coverage$
^kallithea\.db$
^test\.db$
^Kallithea\.egg-info$
^my\.ini$
^fabfile.py
^\.idea$
^\.cache$