Lukas Fleischer 209b0b6eda Mitigate JSONP callback vulnerabilities ... The callback parameter of the RPC interface currently allows for specifying a prefix of arbitrary length of the returned result. This can be exploited by certain attacks. As a countermeasure, this patch restricts the allowed character set for the callback name to letters, digits, underscores, parenthesis and dots. It also limits the length of the name to 128 characters. Furthermore, the reflected callback name is now always prepended with "/**/", which is a common workaround to protect against attacks such as Rosetta Flash. Fixes FS#46259. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>		2015-09-12 10:20:03 +02:00
..
html	Allow for logging in via email address	2015-09-11 22:18:31 +02:00
lib	Mitigate JSONP callback vulnerabilities	2015-09-12 10:20:03 +02:00
locale	Add dummy "web/locale/" directory.	2011-04-10 15:40:49 +02:00
template	Move package base flagging to a separate form	2015-09-11 22:11:52 +02:00