Felix Eckhofer ef721fc430 Add config variable 'proxy_whitelist' ...

HTTP headers X_FORWARDED_* and X_REAL_IP are only evaluated when
received from an IP listed in proxy_whitelist. Furthermore, only the
last non-trusted IP from X-Forwarded-For is used in place of the real
ip.

Without this, an attacker can easily spoof the headers and control the
result of the ip or ssl check.

This fixes several problems with [3a4c9f42], [4d480b36] and [a520f331] as
mentioned in #1489729.

2014-03-26 20:44:16 +01:00

..

include

Make sure parent folder selector always contains parent folder

2014-03-22 14:55:12 +01:00

js

Disable link registering mailto: protocol handler if not supported by the browser (#1489569)

2014-03-21 18:32:13 +01:00

lib

Add config variable 'proxy_whitelist'

2014-03-26 20:44:16 +01:00

localization

Synchrnonized translations from Transifex

2014-03-21 14:12:22 +01:00

resources

Fix browser warnings on PDF plugin detection (#1489118)

2013-05-23 15:43:58 +02:00

steps

Make sure parent folder selector always contains parent folder

2014-03-22 14:55:12 +01:00