Matt Pass ab8ad37467 strClean $_GET value first

2014-05-03 12:08:30 +01:00

..

bug-files-check.php

Include headers lib & csrf hidden form field

2014-04-18 17:57:54 +01:00

config___settings.php

…

config___users-template.php

…

download.php

Don't allow directory traversal

2014-04-23 07:12:13 +01:00

editor.css

…

file-control.php

Strip ../ so we don't have dir traversal vuln

2014-04-26 12:24:01 +01:00

file-type-icons.css

8 new languages added

2014-04-10 10:04:28 +01:00

file-types.css

…

files.css

…

foldcode.js

…

get-branch.php

xssClean the displayed file/folder name

2014-04-26 12:23:29 +01:00

headers.php

Cannot use $_REQUEST, should be $_GET || $_POST

2014-04-23 07:23:02 +01:00

help.css

…

help.php

Include headers lib & csrf hidden form field

2014-04-18 17:57:54 +01:00

ice-coder.css

…

ice-coder.js

If we have GET QS params, add &crsf=xyz to end

2014-04-26 16:12:55 +01:00

ice-coder.min.js

If we have GET QS params, add &crsf=xyz to end

2014-04-26 16:12:55 +01:00

login.php

Include headers lib & csrf hidden form field

2014-04-18 17:57:54 +01:00

mmd.js

…

multiple-results.css

…

multiple-results.php

Include headers lib & csrf hidden form field

2014-04-18 17:57:54 +01:00

php.ini

…

plugins-display.php

Include headers lib & csrf hidden form field

2014-04-18 17:57:54 +01:00

plugins-manager.css

…

plugins-manager.php

strClean $_GET value first

2014-05-03 12:08:30 +01:00

properties.css

…

properties.php

Include headers lib & csrf hidden form field

2014-04-18 17:57:54 +01:00

settings-common.php

strClean now replaces javascript:

2014-04-26 12:25:12 +01:00

settings-save-current-files.php

…

settings-screen.css

Darker side text, blue links

2014-04-26 14:59:18 +01:00

settings-screen.php

Removed list of people, now on website

2014-04-26 14:59:53 +01:00

settings-update.php

xssClean using 'html' filter

2014-04-23 07:43:17 +01:00

settings.php

…

updater.php

Also attempt to get over https, then http

2014-04-26 16:55:55 +01:00