Files
@ b9b719fb4774
Branch filter:
Location: kallithea/docs/usage/backup.rst - annotation
b9b719fb4774
512 B
text/prs.fallenstein.rst
search: fix XSS vulnerability in search results
The search feature did not correctly escape all arguments when displaying
search matches and linking to the corresponding files.
An attacker that can control the contents of a repository could thus cause
a cross-site scripting (XSS) vulnerability.
Fix the problem by removing the overall h.literal call that is only needed
for the HTML entity » and splitting the link instead.
We take the opportunity to improving the destination of the part before
» which is the path to the repository. Instead of pointing to the
search result, point to the repository itself.
The part after » remains linked to the file containing the search
match.
Reported by Bob Hogg <wombat@rwhogg.site> (thanks!).
The search feature did not correctly escape all arguments when displaying
search matches and linking to the corresponding files.
An attacker that can control the contents of a repository could thus cause
a cross-site scripting (XSS) vulnerability.
Fix the problem by removing the overall h.literal call that is only needed
for the HTML entity » and splitting the link instead.
We take the opportunity to improving the destination of the part before
» which is the path to the repository. Instead of pointing to the
search result, point to the repository itself.
The part after » remains linked to the file containing the search
match.
Reported by Bob Hogg <wombat@rwhogg.site> (thanks!).
af371e206ec5 af371e206ec5 17c9393e9645 e73a69cb98dc af371e206ec5 af371e206ec5 af371e206ec5 af371e206ec5 af371e206ec5 af371e206ec5 e73a69cb98dc af371e206ec5 fbbe80e3322b af371e206ec5 af371e206ec5 af371e206ec5 4e6dfdb3fa01 4e6dfdb3fa01 af371e206ec5 af371e206ec5 af371e206ec5 af371e206ec5 af371e206ec5 e73a69cb98dc af371e206ec5 af371e206ec5 4e6dfdb3fa01 | .. _backup:
====================
Backing up Kallithea
====================
Settings
--------
Just copy your .ini file, it contains all Kallithea settings.
Whoosh index
------------
The Whoosh index is located in the ``data/index`` directory where you installed
Kallithea, i.e., the same place where the ini file is located
Database
--------
When using sqlite just copy kallithea.db.
Any other database engine requires a manual backup operation.
A database backup will contain all gathered statistics.
|