aboutsummaryrefslogtreecommitdiffstats
path: root/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
diff options
context:
space:
mode:
authorKlaus Weidenbach <Klaus.Weidenbach@gmx.net>2017-03-18 17:50:05 +0100
committerKlaus Weidenbach <Klaus.Weidenbach@gmx.net>2017-03-26 00:41:27 +0100
commitf718e2b0db0fe3477212a8dd6c3ec067f4432862 (patch)
tree8dfbd3b3d4bdcd967b50f1ee4655440bcdef5bb8 /library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
parent2115eb26a7fd2ca937286bd4e98ab74c7d6e9525 (diff)
downloadvolse-hubzilla-f718e2b0db0fe3477212a8dd6c3ec067f4432862.tar.gz
volse-hubzilla-f718e2b0db0fe3477212a8dd6c3ec067f4432862.tar.bz2
volse-hubzilla-f718e2b0db0fe3477212a8dd6c3ec067f4432862.zip
:arrow_up: Update HTML Purifier library.
Updated HTML Purifier from 4.6.0 to 4.9.2 with better PHP7 compatibility. Used composer to manage this library.
Diffstat (limited to 'library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt')
-rw-r--r--library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt30
1 files changed, 0 insertions, 30 deletions
diff --git a/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
deleted file mode 100644
index 1e17c1d46..000000000
--- a/library/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
+++ /dev/null
@@ -1,30 +0,0 @@
-URI.MungeSecretKey
-TYPE: string/null
-VERSION: 3.1.1
-DEFAULT: NULL
---DESCRIPTION--
-<p>
- This directive enables secure checksum generation along with %URI.Munge.
- It should be set to a secure key that is not shared with anyone else.
- The checksum can be placed in the URI using %t. Use of this checksum
- affords an additional level of protection by allowing a redirector
- to check if a URI has passed through HTML Purifier with this line:
-</p>
-
-<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre>
-
-<p>
- If the output is TRUE, the redirector script should accept the URI.
-</p>
-
-<p>
- Please note that it would still be possible for an attacker to procure
- secure hashes en-mass by abusing your website's Preview feature or the
- like, but this service affords an additional level of protection
- that should be combined with website blacklisting.
-</p>
-
-<p>
- Remember this has no effect if %URI.Munge is not on.
-</p>
---# vim: et sw=4 sts=4