4efc3d7b3f
validate_url: relax requirements for URLs, limit additional port/loopback filtering to fetch_file_contents()
4 years ago
a4525d31b2
replace FALSE with false so that static analyzer shuts up about it
4 years ago
57fac84516
rename gettext.inc to gettext.inc.php (cosmetic)
4 years ago
d8619b9a84
auth_internal: cast OTP code to integer before trying to check it
4 years ago
c25edd0024
fetch_file_contents: validate effective URL (after redirects) without CURL
4 years ago
27e695436f
fetch_file_contents: validate effective URL (after redirects) if using CURL
4 years ago
afa0023c51
don't try to update manually disabled feeds even if they haven't been updated before or are marked for a manual update
4 years ago
f41fdef389
add gulp task for less compilation
4 years ago
5415a0e033
add makefile for less to css compilation
4 years ago
37f41a5246
forgotpass: use type strict comparison for reset token
4 years ago
5a7e7e1367
don't try to call hash_equals() on unset user token
4 years ago
f72e6947d5
use hash_equals() correctly
4 years ago
e3adacc588
fix several cases of Db class being invoked as wrong name (as DB)
4 years ago
16c86e2fc3
replace some plain http links with https
4 years ago
a817d3794d
* use get_random_bytes() for CSRF token
...
* get_random_bytes: use PHP7 random_bytes() if it is available
* validate CSRF token using hash_equals
4 years ago
0757ad0406
auth_internal: use type-strict comparison when checking OTP code
4 years ago
89d53a7f49
fix typo in previous
4 years ago
1f79d614c4
fix OTP QR code not displayed because of CSRF token passed as a query
...
parameter
use type-strict comparison when validating CSRF token on the backend
4 years ago
6a4b6cf603
amend previous to 127/8 subnet
4 years ago
213d6330b1
fetch_file_contents: resolve requested hosts and check for possible
...
loopback address
4 years ago
88c4dc405e
build_url: also put query parameters and fragment in resulting URL
...
rewrite_relative_url: simplify handling of relative URLs
4 years ago
9d3c794983
subscribe: allow pre-filling feed URL if passed via query string
4 years ago
da5af2fae0
cached_url: block SVG images because of potential javascript inside
4 years ago
33fdde249e
pass CSRF token to opml import and feed icon replace dialogs
4 years ago
f693ebab21
fix default password nag dialog, load via xhr
4 years ago
77faa5d523
editFeed: only try to reload feed tree in preferences if its actually there
4 years ago
3f9390c45f
comments link: load in new tab
4 years ago
42b5564d1e
editarticletags: load dialog via XHR
4 years ago
0706a328a4
handler: default base csrf_ignore() to false
4 years ago
0a142912d3
backend handler: require CSRF, remove obsolete code
4 years ago
154417d80b
public/logout: require valid CSRF token
4 years ago
cbcb10a272
Feeds: load quickaddfeed and search dialogs via XHR w/ CSRF protection
4 years ago
8080c525fd
- backend: require CSRF token to be passed via POST
...
- do not leak CSRF token via GET request in feed debugger
- rework Article/redirect to use POST
4 years ago
aeaafefa07
don't pass csrf token as a GET parameter to Article
4 years ago
e670ac2ee5
require CSRF token for Article/redirect
4 years ago
7e50c6c4b5
- enable CSRF support earlier
...
- remove rpc/sanityCheck from CSRF-excluded calls
4 years ago
91e1542a82
af_proxy_http: require separate token to access imgproxy
4 years ago
1621abcffc
rewrite_relative_url: validate resulting absolutized URLs
4 years ago
aa89ea7769
validate_url: only allow safe ports (80, 443), disallow access to loopback
4 years ago
6c02fea641
validate_url: add clean()
4 years ago
4abc7d7898
rename base64_img() to image_to_base64()
4 years ago
79f102c25d
af_proxy_http: never print received data directly, always redirect to cached_url
...
cache/getUrl: basename() passed filename just in case
4 years ago
1ee458b5c1
cached_url: perform mimetype validation before possible HOOK_SEND_LOCAL_FILE hooks
4 years ago
0758397dd8
af_redditimgur: don't add embedded blank gif image for rewritten videos
4 years ago
4a074111b5
user preferences: forbid < and > characters when changing passwords (were silently stripped on save because of clean())
4 years ago
da98ba662e
public/subscribe: require valid CSRF token when validating the form
4 years ago
b4cb67e77f
remove csrf token from rpc method sanityCheck
4 years ago
c3d14e1fa5
- fix multiple vulnerabilities in af_proxy_http
...
- fix vulnerability in rewrite_relative_url() which prevented some URLs from being properly absolutized
- fetch_file_contents: validate all URLs before requesting them
- validate URLs: explicitly whitelist http and https scheme, forbid everything else
- DiskCache/cached_url: only serve whitelisted content types (images, video)
- simplify filename/URL handling code, remove and consolidate some less-used functions
4 years ago
5b17fdc362
Merge branch 'weblate-integration'
4 years ago
a922b3cc6d
order_to_override_query: allow HOOK_HEADLINES_CUSTOM_SORT_OVERRIDE plugins to override built-in sorting
4 years ago
Andrew Dolgov