Mercurial > kallithea
view docs/usage/backup.rst @ 7547:a8d873e9cab0
compare: prevent XSS due to unescaped branch/tag/bookmark names
In the revision selection dropdown of the 'Compare' functionality, the
branch/tag/bookmark names were not correctly escaped.
This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.
Fix the problem by correctly escaping the branch/tag/bookmarks.
| author | Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> |
|---|---|
| date | Tue, 26 Feb 2019 21:27:42 +0100 |
| parents | fbbe80e3322b |
| children |
line wrap: on
line source
.. _backup: ==================== Backing up Kallithea ==================== Settings -------- Just copy your .ini file, it contains all Kallithea settings. Whoosh index ------------ The Whoosh index is located in the ``data/index`` directory where you installed Kallithea, i.e., the same place where the ini file is located Database -------- When using sqlite just copy kallithea.db. Any other database engine requires a manual backup operation. A database backup will contain all gathered statistics.