summaryrefslogtreecommitdiffstats
path: root/HACKING
diff options
context:
space:
mode:
authorLukas Fleischer <archlinux@cryptocrack.de>2013-08-27 02:18:59 +0200
committerLukas Fleischer <archlinux@cryptocrack.de>2013-08-27 02:27:19 +0200
commit69b98efa35d48d794394df938741fdfc342cfb84 (patch)
tree34a032d8d80c9fabb666f775e3d7549dc58584bb /HACKING
parent3bc951e3d87eaf692a7e47cf16a28d838c7cb2bd (diff)
downloadaurweb-69b98efa35d48d794394df938741fdfc342cfb84.tar.xz
Re-add CRSF tokens to most package actions
We fixed all known CRSF vulnerabilities in commit 2c93f0a (Implement token system to fix CSRF vulnerabilities, 2012-06-23). c349cb2 (Add virtual path support for package actions, 2012-07-17) partly reverted this by injecting a valid CRSF token when virtual paths are in use. This patch allows for keeping the virtual path feature, while reintroducing POST forms and CRSF tokens. Actions like package flagging, votes and notifications are no longer prone to CRSF (see FS#35437 for details). Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Diffstat (limited to 'HACKING')
0 files changed, 0 insertions, 0 deletions