Mercurial > kallithea
view docs/usage/debugging.rst @ 7547:a8d873e9cab0
compare: prevent XSS due to unescaped branch/tag/bookmark names
In the revision selection dropdown of the 'Compare' functionality, the
branch/tag/bookmark names were not correctly escaped.
This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.
Fix the problem by correctly escaping the branch/tag/bookmarks.
author | Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> |
---|---|
date | Tue, 26 Feb 2019 21:27:42 +0100 |
parents | 87ac42db389c |
children |
line wrap: on
line source
.. _debugging: =================== Debugging Kallithea =================== If you encounter problems with Kallithea, here are some instructions on how to debug them. .. note:: First make sure you're using the latest version available. Enable detailed debug --------------------- Kallithea uses the standard Python ``logging`` module to log its output. By default only loggers with ``INFO`` level are displayed. To enable full output change ``level = DEBUG`` for all logging handlers in the currently used .ini file. This change will allow you to see much more detailed output in the log file or console. This generally helps a lot to track issues. Enable interactive debug mode ----------------------------- To enable interactive debug mode simply comment out ``set debug = false`` in the .ini file. This will trigger an interactive debugger each time there is an error in the browser, or send a http link if an error occurred in the backend. This is a great tool for fast debugging as you get a handy Python console right in the web view. .. warning:: NEVER ENABLE THIS ON PRODUCTION! The interactive console can be a serious security threat to your system.