nodiscc [Sun, 9 Nov 2014 20:09:43 +0000 (21:09 +0100)]
use urlencode in tagcloud links
* prevents unproper escaping of characters like '&'
* fixes https://github.com/sebsauvage/Shaarli/issues/85
* fixes https://github.com/shaarli/Shaarli/issues/48
nodiscc [Thu, 9 Oct 2014 13:45:23 +0000 (15:45 +0200)]
Update README:
* Add screenshots
* Use Mediacrush as a CDN for images to reduce load on sebsauvage.net
* Improve page layout/sections
* Reorder list of features
* Add links to wiki and bug tracker
* Add proper download links for stable/dev channels
* Improve copyright/license notice
nodiscc [Tue, 21 Oct 2014 13:31:20 +0000 (15:31 +0200)]
thumbnails: force HTTPS for youtube, imgur, vimeo
* other services also provide thumbs over HTTPS, but the rewrite expression is more complex, so left out for now
nodiscc [Thu, 23 Oct 2014 15:47:30 +0000 (17:47 +0200)]
Make ATOM toolbar button optional
* ATOM button display is now configurable using the SHOW_ATOM variable in index.php or data/options.php (defaults to false)
* Fixes https://github.com/shaarli/Shaarli/issues/24
nodiscc [Mon, 20 Oct 2014 17:14:52 +0000 (19:14 +0200)]
add link: in case of empty URL (self-post), prepend "Note: " to the title
* Thanks to qwertygc (https://github.com/shaarli/Shaarli/pull/23)
* Fix small typo
nodiscc [Wed, 27 Aug 2014 20:52:45 +0000 (22:52 +0200)]
replace unlicensed icons/images, add proper credits
* fugue icons (http://p.yusukekamiyamane.com/) CC-BY-SA license
* ornimental bookend (https://openclipart.org/detail/19869/ornimental-bookend---left-by-j4p4n) Public domain license
* Paper_texture_v5_by_bashcorpo_w1000.jpg source found at http://bashcorpo.deviantart.com/art/Grungy-paper-texture-v-5-22966998 under Public Domain license
* linecons (https://www.iconfinder.com/iconsets/linecons-free-vector-icons-pack) CC-BY license
* add credits to COPYING, (get list of committers with git shortlog -sne, and previous contributors from the author's website)
* Fixes https://github.com/shaarli/Shaarli/issues/10
* Fixes https://github.com/sebsauvage/Shaarli/issues/8
nodiscc [Mon, 11 Aug 2014 18:41:50 +0000 (20:41 +0200)]
Fix grammar, punctuation, spelling, trailing whitepaces and newlines; Fix typo in css
Based on respencer's work at https://github.com/respencer/Shaarli/
Closes https://github.com/sebsauvage/Shaarli/pull/103
nodiscc [Sun, 10 Aug 2014 22:04:51 +0000 (00:04 +0200)]
bookmarklet: use selected text as description when adding a new link
* Based on romnGit's work at https://github.com/sebsauvage/Shaarli/pull/104
* Fixes https://github.com/shaarli/Shaarli/issues/18
* Closes https://github.com/sebsauvage/Shaarli/pull/104
* Fixes https://github.com/sebsauvage/Shaarli/issues/53
* Fixes https://github.com/sebsauvage/Shaarli/issues/129
* Fixes https://github.com/sebsauvage/Shaarli/issues/33
Instead of trusting the php session, it uses a cookie. The php session
sooner or later is distroyed if not used. It depends upon the server
settings. Using a cookie ensures that one really stays signed in.
Dev notes: I wanted to avoid merge conflicts, stay with the main
developper standards and keep the "index.php" in one file. That's why
the code may not be that nice. My own dev level my also explain.
jQuery has been removed from all pages, except those who really require
it (like autocomplete in link edition).
Immediate gain: All pages weight 286 kb LESS ! \o/
Highlighting in search results has also been temporarly removed (and
will be re-implemented).
* QR-Code generation now uses a client-side javascript library instead of an external service. This is better for user privacy.
* Library used is http://neocotic.com/qr.js/ (11 kb).
* jQuery is no longer used to display QR-Code (this is a first step in removing jQuery entirely).
* This library is loaded *only* if the QR-Code icon is clicked.
* If javascript is disabled, it will fallback to the external service.
* External service was changed from "invx.com" to "qrfree.kaywa.com" because invx has become bloated.
By loading the javascript library *only* if the icon is clicked, it will prevent the 11 kb lib to be loaded in every page.
NETSCAPE-Bookmark sometimes contains dates as milliseconds instead of
seconds.
For instance, this is the case of the files gererated for Google +1s by
Google Takeout.
This patch make these files compatible.
SERVER_NAME changed to HTTP_HOST because SERVER_NAME can cause problems
on some misconfigured hosts. HTTP_HOST is usually more reliable with
those servers. (cf.
http://stackoverflow.com/questions/2297403/http-host-vs-server-name).
This should cause less problem on most hosts.
Title : Shaarli Vulnerabilities
Author : @erwan_lr | @_WPScan_
Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli
Download : https://github.com/sebsauvage/Shaarli/archive/master.zip |
http://sebsauvage.net/files/shaarli_0.0.40beta.zip
Affected versions : master-705F835, 0.0.40-beta (versions below may also
be vulnerable)
Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards
Persistent XSS :
- During the instalation or configuration modification, the title field
is vulnerable. e.g <script>alert(1)</script>
Quotes can not be used because of var_export(), but String.fromCharCode
works
- The url field of a link is vulnerable :
When there is no redirector : javascript:alert(1)
Then, the code is triggered when a user click the url of a link
Or with a classic XSS : "><script>alert(1)</script>
Unvalidated Redirects and Forwards :
A request with the param linksperpage or privateonly can be used to
redirect a user to an arbitrary referer
e.g
GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1
Host: 127.0.0.1
Referer: https://duckduckgo.com
Added option to disable jQuery and heavy javascript
Shaarli uses light Javascript in its normal operation, and some jQuery
for some features (autocomplete in tags, QR-Code popup...).
jQuery can be slow on small computers. An option has been added in
configuration screen to disable javascript features which are hard on
CPU.
(Note that the Picture Wall is awfully heavy *without* jQuery.)
(Side note: A *LOT* of users want Shaarli to work without javasript at
all, if possible. That's why I try to use as few javascript as possible:
It keeps Shaarli pages fast.)
projects / github / shaarli / Shaarli.git / log
