diff options
author | Mario Vavti <mario@mariovavti.com> | 2017-05-31 09:56:35 +0200 |
---|---|---|
committer | Mario Vavti <mario@mariovavti.com> | 2017-05-31 09:56:35 +0200 |
commit | 47d55694a4c84b6c12c0db61a69bcac8b671b20e (patch) | |
tree | b15e96f4ea67e2214a66a9d28dafaf53d25b98ec /library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt | |
parent | 087f9784e3c5a860ed2b86e7f9e8e9f312038546 (diff) | |
parent | f0e615dee529e031663576286345141ad2996974 (diff) | |
download | volse-hubzilla-47d55694a4c84b6c12c0db61a69bcac8b671b20e.tar.gz volse-hubzilla-47d55694a4c84b6c12c0db61a69bcac8b671b20e.tar.bz2 volse-hubzilla-47d55694a4c84b6c12c0db61a69bcac8b671b20e.zip |
Merge branch '2.4RC'2.4
Diffstat (limited to 'library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt')
-rw-r--r-- | library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt | 30 |
1 files changed, 0 insertions, 30 deletions
diff --git a/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt deleted file mode 100644 index 1e17c1d46..000000000 --- a/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt +++ /dev/null @@ -1,30 +0,0 @@ -URI.MungeSecretKey -TYPE: string/null -VERSION: 3.1.1 -DEFAULT: NULL ---DESCRIPTION-- -<p> - This directive enables secure checksum generation along with %URI.Munge. - It should be set to a secure key that is not shared with anyone else. - The checksum can be placed in the URI using %t. Use of this checksum - affords an additional level of protection by allowing a redirector - to check if a URI has passed through HTML Purifier with this line: -</p> - -<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre> - -<p> - If the output is TRUE, the redirector script should accept the URI. -</p> - -<p> - Please note that it would still be possible for an attacker to procure - secure hashes en-mass by abusing your website's Preview feature or the - like, but this service affords an additional level of protection - that should be combined with website blacklisting. -</p> - -<p> - Remember this has no effect if %URI.Munge is not on. -</p> ---# vim: et sw=4 sts=4 |