Bharat Mediratta 8f9a943f55 Fix a bunch of XSS vulnerabilities turned up by manual inspection ...

using the checklist in ticket #385.

2009-07-01 17:57:39 -07:00

..

admin_advanced_settings.php

Fix a bunch of XSS vulnerabilities turned up by manual inspection

2009-07-01 17:57:39 -07:00

admin_dashboard.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

admin_graphics.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

admin_languages.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

admin_maintenance.php

Fix log links. html::anchor() implicitly calls url::site(), calling

2009-06-10 20:37:38 -07:00

admin_modules.php

Fix a bunch of XSS vulnerabilities turned up by manual inspection

2009-07-01 17:57:39 -07:00

admin_theme_options.php

Add a new "show credits" check box in the theme options so that you

2009-06-23 16:05:32 -07:00

admin_themes.php

i18n theme name / description in admin themes. Partial fix for ticket 471.

2009-06-29 22:22:27 -07:00

admin.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

after_install.php

Restructure things so that the application is now just another module.

2009-05-27 15:07:27 -07:00

albums.php

Fix a bunch of XSS vulnerabilities turned up by manual inspection

2009-07-01 17:57:39 -07:00

combined.php

Use the appropriate content-type for javascript (application/javascript).

2009-06-29 21:59:00 -07:00

file_proxy.php

Re-add Session::abort_save(). It was reverted as part of the earlier

2009-06-30 20:51:02 -07:00

items.php

Restructure things so that the application is now just another module.

2009-05-27 15:07:27 -07:00

l10n_client.php

Add option to list *all* l10n messages (that have been indexed) in l10n UI

2009-06-16 20:25:01 -07:00

maintenance.php

Restructure things so that the application is now just another module.

2009-05-27 15:07:27 -07:00

move.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

movies.php

Fix a bunch of XSS vulnerabilities turned up by manual inspection

2009-07-01 17:57:39 -07:00

packager.php

Rename package -> packager (it's a noun which has verbs on it).

2009-06-10 01:23:18 -07:00

permissions.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

photos.php

Fix a bunch of XSS vulnerabilities turned up by manual inspection

2009-07-01 17:57:39 -07:00

quick.php

Fix a bunch of XSS vulnerabilities turned up by manual inspection

2009-07-01 17:57:39 -07:00

rest.php

Security pass over all controller code. Mostly adding CSRF checking

2009-06-01 22:40:22 -07:00

simple_uploader.php

If the argument to app() is not an album id, switch to the item parent.

2009-06-29 20:23:23 -07:00

upgrader.php

Rejigger the way we handle "done" status in the upgrader. Now we

2009-06-30 18:28:55 -07:00