summaryrefslogtreecommitdiff
path: root/Documentation/howto
diff options
context:
space:
mode:
authorLibravatar Jakub Narebski <jnareb@gmail.com>2011-06-04 10:43:35 +0200
committerLibravatar Junio C Hamano <gitster@pobox.com>2011-06-05 10:38:47 -0700
commitbee6ea17a1bab824eba6133eefc3c70b219ec98c (patch)
treec19d98d92c759feaae3ad9b8ebbdd6cb1081efb5 /Documentation/howto
parentgitweb: add $prevent_xss option to prevent XSS by repository content (diff)
downloadtgif-bee6ea17a1bab824eba6133eefc3c70b219ec98c.tar.xz
gitweb: Fix usability of $prevent_xss
With XSS prevention on (enabled using $prevent_xss), blobs ('blob_plain') of all types except a few known safe ones are served with "Content-Disposition: attachment". However the check was too strict; it didn't take into account optional parameter attributes, media-type = type "/" subtype *( ";" parameter ) as described in RFC 2616 http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.17 http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.7 This fixes that, and it for example treats following as safe MIME media type: text/plain; charset=utf-8 Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'Documentation/howto')
0 files changed, 0 insertions, 0 deletions