fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-26 06:39:56 +09:00
Code Issues Projects Releases Packages Wiki Activity

merge from 1.6 ( html purifier lib )

Browse source 
git-svn-id: http://xe-core.googlecode.com/svn/branches/1.5.0@10579 201d5d3c-b55e-5fd7-737f-ddc643e51545
This commit is contained in:
ovclas 2012-04-20 07:34:00 +00:00
parent 8943ff97f3
commit 7ea7157ce7
813 changed files with 65203 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

30
classes/security/htmlpurifier/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt Normal file
View file

@ -0,0 +1,30 @@
URI.MungeSecretKey
TYPE: string/null
VERSION: 3.1.1
DEFAULT: NULL
--DESCRIPTION--
<p>
This directive enables secure checksum generation along with %URI.Munge.
It should be set to a secure key that is not shared with anyone else.
The checksum can be placed in the URI using %t. Use of this checksum
affords an additional level of protection by allowing a redirector
to check if a URI has passed through HTML Purifier with this line:
</p>
<pre>$checksum === sha1($secret_key . ':' . $url)</pre>
<p>
If the output is TRUE, the redirector script should accept the URI.
</p>
<p>
Please note that it would still be possible for an attacker to procure
secure hashes en-mass by abusing your website's Preview feature or the
like, but this service affords an additional level of protection
that should be combined with website blacklisting.
</p>
<p>
Remember this has no effect if %URI.Munge is not on.
</p>
--# vim: et sw=4 sts=4