Mercurial > kallithea
view MANIFEST.in @ 5523:38d1c99cd000 stable
login: enhance came_from validation
Drop urlparse and just validate that came_from is a RFC 3986 compliant path.
This blocks an HTTP header injection vulnerability discovered by
Gjoko Krstic <gjoko@zeroscience.mk> of Zero Science Lab (CVE-2015-5285)
author | Søren Løvborg <sorenl@unity3d.com> |
---|---|
date | Wed, 23 Sep 2015 16:09:14 +0200 |
parents | 19267f233d39 |
children | 968f2d4214e8 |
line wrap: on
line source
include Apache-License-2.0.txt include CONTRIBUTORS include COPYING include LICENSE-MERGELY.html include LICENSE.md include MIT-Permissive-License.txt include README.rst include development.ini recursive-include docs * recursive-include init.d * include kallithea/bin/ldap_sync.conf include kallithea/bin/template.ini.mako include kallithea/config/deployment.ini_tmpl recursive-include kallithea/i18n * recursive-include kallithea/lib/dbmigrate *.py_tmpl README migrate.cfg recursive-include kallithea/public * recursive-include kallithea/templates * recursive-include kallithea/tests/fixtures * recursive-include kallithea/tests/scripts * include kallithea/tests/test.ini include kallithea/tests/vcs/aconfig