X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=inc%2F3rdparty%2Fhtmlpurifier%2FHTMLPurifier%2FConfigSchema%2Fschema%2FURI.MungeSecretKey.txt;fp=inc%2F3rdparty%2Fhtmlpurifier%2FHTMLPurifier%2FConfigSchema%2Fschema%2FURI.MungeSecretKey.txt;h=123b6e26b80ddc091e0f7591f929849c4b3c02fd;hb=d4949327efa15b492cab1bef3fe074290a328a17;hp=0000000000000000000000000000000000000000;hpb=c9bd17a1007bb78e5de0775efca01df0fb515031;p=github%2Fwallabag%2Fwallabag.git

diff --git a/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
new file mode 100644
index 00000000..123b6e26
--- /dev/null
+++ b/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
@@ -0,0 +1,30 @@
+URI.MungeSecretKey
+TYPE: string/null
+VERSION: 3.1.1
+DEFAULT: NULL
+--DESCRIPTION--
+<p>
+    This directive enables secure checksum generation along with %URI.Munge.
+    It should be set to a secure key that is not shared with anyone else.
+    The checksum can be placed in the URI using %t. Use of this checksum
+    affords an additional level of protection by allowing a redirector
+    to check if a URI has passed through HTML Purifier with this line:
+</p>
+
+<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre>
+
+<p>
+    If the output is TRUE, the redirector script should accept the URI.
+</p>
+
+<p>
+    Please note that it would still be possible for an attacker to procure
+    secure hashes en-mass by abusing your website's Preview feature or the
+    like, but this service affords an additional level of protection
+    that should be combined with website blacklisting.
+</p>
+
+<p>
+    Remember this has no effect if %URI.Munge is not on.
+</p>
+--# vim: et sw=4 sts=4