canyonknight 2c93f0a98f Implement token system to fix CSRF vulnerabilities ... Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>		2012-06-24 10:59:23 +02:00
..
stats	Fix some more XSS vulnerabilities	2012-02-19 04:48:31 +01:00
actions_form.php	Implement token system to fix CSRF vulnerabilities	2012-06-24 10:59:23 +02:00
footer.php	Escape all output strings in the header and footer	2012-02-19 05:21:48 +01:00
header.php	Escape all output strings in the header and footer	2012-02-19 05:21:48 +01:00
login_form.php	web/template/login_form.php: Escape the request URI	2011-09-05 16:56:09 +02:00
pkg_comment_form.php	Implement token system to fix CSRF vulnerabilities	2012-06-24 10:59:23 +02:00
pkg_comments.php	Implement token system to fix CSRF vulnerabilities	2012-06-24 10:59:23 +02:00
pkg_details.php	Implement token system to fix CSRF vulnerabilities	2012-06-24 10:59:23 +02:00
pkg_search_form.php	rename *.inc files to *.inc.php and adjust imports and references	2011-06-22 15:15:04 +02:00
pkg_search_results.php	Implement token system to fix CSRF vulnerabilities	2012-06-24 10:59:23 +02:00
search_accounts_form.php	Fix broken XHTML.	2011-03-11 19:00:50 +01:00
template.phps	rename *.inc files to *.inc.php and adjust imports and references	2011-06-22 15:15:04 +02:00
tu_details.php	Implement token system to fix CSRF vulnerabilities	2012-06-24 10:59:23 +02:00
tu_list.php	test return value from db_query before assuming it is valid	2011-05-17 10:43:42 +02:00