diff options
| author | Klaus <Klaus.Weidenbach@gmx.net> | 2017-03-27 21:39:02 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-03-27 21:39:02 +0200 |
| commit | 6375401e0af6c52d151dd2b944aa6a054b8ddc05 (patch) | |
| tree | 982ab84421ffa8ee2c48f38cc2d1eef11853dbf6 /library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt | |
| parent | b6b62506c5f4ed5bc354d548702538bda36aff36 (diff) | |
| parent | f718e2b0db0fe3477212a8dd6c3ec067f4432862 (diff) | |
| download | volse-hubzilla-6375401e0af6c52d151dd2b944aa6a054b8ddc05.tar.gz volse-hubzilla-6375401e0af6c52d151dd2b944aa6a054b8ddc05.tar.bz2 volse-hubzilla-6375401e0af6c52d151dd2b944aa6a054b8ddc05.zip | |
Merge pull request #701 from dawnbreak/HTMLpurifier
HTMLPurifier library update
Diffstat (limited to 'library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt')
| -rw-r--r-- | library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt | 30 |
1 files changed, 0 insertions, 30 deletions
diff --git a/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt deleted file mode 100644 index 1e17c1d46..000000000 --- a/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt +++ /dev/null @@ -1,30 +0,0 @@ -URI.MungeSecretKey -TYPE: string/null -VERSION: 3.1.1 -DEFAULT: NULL ---DESCRIPTION-- -<p> - This directive enables secure checksum generation along with %URI.Munge. - It should be set to a secure key that is not shared with anyone else. - The checksum can be placed in the URI using %t. Use of this checksum - affords an additional level of protection by allowing a redirector - to check if a URI has passed through HTML Purifier with this line: -</p> - -<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre> - -<p> - If the output is TRUE, the redirector script should accept the URI. -</p> - -<p> - Please note that it would still be possible for an attacker to procure - secure hashes en-mass by abusing your website's Preview feature or the - like, but this service affords an additional level of protection - that should be combined with website blacklisting. -</p> - -<p> - Remember this has no effect if %URI.Munge is not on. -</p> ---# vim: et sw=4 sts=4 |