Protect against XSS and CSRF + some improvements #30
Conversation
1. add paths for protecting against csrf and xss 2. check Token is valid and recent
1. add paths for protecting csrf and xss 2. check Token is valid and recent
1. add paths for protecting against csrf and xss 2. check Token is valid and recent
1. start session, add Token 2. autocomplete = "off"
1. start session, add Token 2. autocomplete="off"
1. start session, add Token 2. autocomplete="off"
Use HTMLPurifier only for title, description, and copyright
From isset($_POST['login']) to isset($_POST['title'])
|
There are some new problems with the content editor and rendered content contain page templates. When a page template is added the reorder buttons and a rouge X gets rendered when the content is displayed. The reorder button should only appear in the Page Template preview in the content editor.
Can any of the HTML Purifier files be eliminated. There seems to be a lot of files that are not required. Also things like the form_demo.php in the crsf folder should be cleaned out. I have not done a thorough code review. This pull request should be broken down into smaller more manageable chunks. And, a little more description provided with each. As it is I can't merge this pull request. |
We use TABLE_PREFIX to prevent error "Table ac_tests_questions doesn't exist" when editing or deleting created tests
We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent Reflected XSS for p parameter
We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent XSS for vulnerable or suspected parameters
We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent XSS for vulnerable or suspected parameters
We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent XSS for vulnerable or suspected parameters
We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent Reflected XSS for title parameter
We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent Reflected XSS for _cid parameter
1. We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent XSS for vulnerable or suspected parameters 2. If CSRF_Token is not valid and not recent, then make values from user unchangeable by CRSF Payload
We depend on htmlspecialchars, trim, stripslashes, and strip_tags to prevent XSS for vulnerable or suspected parameters
|
Hello.., |
Hello..,
This is a pull request for issue #29 .