external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
aurweb/web/lib
History
Lukas Fleischer 209b0b6eda Mitigate JSONP callback vulnerabilities 
The callback parameter of the RPC interface currently allows for
specifying a prefix of arbitrary length of the returned result. This can
be exploited by certain attacks.

As a countermeasure, this patch restricts the allowed character set for
the callback name to letters, digits, underscores, parenthesis and dots.
It also limits the length of the name to 128 characters. Furthermore,
the reflected callback name is now always prepended with "/**/", which
is a common workaround to protect against attacks such as Rosetta Flash.

Fixes FS#46259.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2015-09-12 10:20:03 +02:00
..
acctfuncs.inc.php Allow for logging in via email address 2015-09-11 22:18:31 +02:00
aur.inc.php Allow for logging in via email address 2015-09-11 22:18:31 +02:00
aurjson.class.php Mitigate JSONP callback vulnerabilities 2015-09-12 10:20:03 +02:00
cachefuncs.inc.php Remove unnecessary database connection parameter from all functions 2013-02-10 12:10:38 +01:00
confparser.inc.php confparser: Add function for getting the items of a section 2015-06-14 17:58:56 +02:00
credentials.inc.php Add comment edit icon and form 2015-08-08 12:59:23 +02:00
DB.class.php Use an INI-style configuration file 2014-10-24 10:03:54 +02:00
feedcreator.class.php Avoid use of "<b>"/"</b>" 2012-09-24 12:23:05 +02:00
gettext.php Style fixes: Capitalization of "true" and "false" 2014-02-06 16:32:31 +01:00
pkgbasefuncs.inc.php Require comments when flagging packages out-of-date 2015-09-11 22:14:26 +02:00
pkgfuncs.inc.php Allow users to unflag packages they flagged themselves 2015-08-30 16:51:14 +02:00
pkgreqfuncs.inc.php Port notification routines to Python 2015-08-08 12:59:23 +02:00
routing.inc.php Move registration code to a separate unit 2015-06-27 13:04:03 +02:00
stats.inc.php Do not use the term "unsupported" for AUR packages 2015-08-08 12:59:24 +02:00
streams.php Add php-gettext libraries to "web/lib/". 2011-04-10 15:40:49 +02:00
translator.inc.php Add Arabic translation 2015-06-27 13:04:03 +02:00
version.inc.php Release 4.0.0 2015-08-08 12:58:28 +02:00