[add] HTML Purifier added to clean code

[github/wallabag/wallabag.git] / inc / 3rdparty / htmlpurifier / HTMLPurifier / ConfigSchema / schema / URI.MungeSecretKey.txt

diff --git a/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
new file mode 100644 (file)
index 0000000..123b6e2
--- /dev/null
+++ b/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
@@ -0,0 +1,30 @@
+URI.MungeSecretKey\r
+TYPE: string/null\r
+VERSION: 3.1.1\r
+DEFAULT: NULL\r
+--DESCRIPTION--\r
+<p>\r
+    This directive enables secure checksum generation along with %URI.Munge.\r
+    It should be set to a secure key that is not shared with anyone else.\r
+    The checksum can be placed in the URI using %t. Use of this checksum\r
+    affords an additional level of protection by allowing a redirector\r
+    to check if a URI has passed through HTML Purifier with this line:\r
+</p>\r
+\r
+<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre>\r
+\r
+<p>\r
+    If the output is TRUE, the redirector script should accept the URI.\r
+</p>\r
+\r
+<p>\r
+    Please note that it would still be possible for an attacker to procure\r
+    secure hashes en-mass by abusing your website's Preview feature or the\r
+    like, but this service affords an additional level of protection\r
+    that should be combined with website blacklisting.\r
+</p>\r
+\r
+<p>\r
+    Remember this has no effect if %URI.Munge is not on.\r
+</p>\r
+--# vim: et sw=4 sts=4\r