kallithea Files · docs/changelog.rst

Files @ 38d1c99cd000

Branch filter:

Location: kallithea/docs/changelog.rst

38d1c99cd000 200 B text/prs.fallenstein.rst Show Annotation Show as Raw Download as Raw

Søren Løvborg

login: enhance came_from validation

Drop urlparse and just validate that came_from is a RFC 3986 compliant path.

This blocks an HTTP header injection vulnerability discovered by
Gjoko Krstic <gjoko@zeroscience.mk> of Zero Science Lab (CVE-2015-5285)

.. _changelog:

=========
Changelog
=========

Kallithea project doesn't keep its changelog here.  We refer you to our `Mercurial logs`__.


.. __: https://kallithea-scm.org/repos/kallithea/changelog