aboutsummaryrefslogtreecommitdiffhomepage
path: root/tpl/page.header.html
Commit message (Collapse)AuthorAgeFilesLines
* Handle errors raised by plugins in template. fixes #370ArthurHoaro2015-11-081-0/+7
|
* Template upgrade to handle plugin zonesArthurHoaro2015-11-071-1/+4
| | | | Add a bunch of plugin placeholders in templates
* Working on shaarli/Shaarli#224ArthurHoaro2015-06-231-1/+1
| | | | | | | | | | | | I reviewed character escaping everywhere with the following ideas: * use a single common function to escape user data: `escape` using `htmlspecialchars`. * sanitize fields in `index.php` after reading them from datastore and before sending them to templates. It means no escaping function in Twig templates. 2 reasons: * it reduces risks of security issue for future user made templates * more readable templates * sanitize user configuration fields after loading them.
* added menu div and cleaned up codeMiloš Jovanović2015-03-111-14/+29
|
* CSS: remove hardcoded style from templatesVirtualTam2014-12-031-2/+2
| | | | | | | | | | | | | | | Fixes shaarli/Shaarli#29 Style elements refactored as follows: - use existing ids and classes if possible, - else, define new ones and stick with the existing naming convention, - remove hardcoded style attributes from RainTPL templates. Exception: In tpl/tagcloud.html, the display size of each tag is computed at page generation. Signed-off-by: VirtualTam <virtualtam@flibidi.org>
* Make ATOM toolbar button optionalnodiscc2014-10-231-1/+3
| | | | | * ATOM button display is now configurable using the SHOW_ATOM variable in index.php or data/options.php (defaults to false) * Fixes https://github.com/shaarli/Shaarli/issues/24
* Adds a configuration variable "titleLink" which allows to customize theChristophe HENRY2014-07-271-1/+1
| | | | link on the title.
* Corrected vulnerabilities (see report below)Sebastien SAUVAGE2013-03-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Title : Shaarli Vulnerabilities Author : @erwan_lr | @_WPScan_ Vendor : http://sebsauvage.net/wiki/doku.php?id=php:shaarli Download : https://github.com/sebsauvage/Shaarli/archive/master.zip | http://sebsauvage.net/files/shaarli_0.0.40beta.zip Affected versions : master-705F835, 0.0.40-beta (versions below may also be vulnerable) Vulnerabilities : Persistent XSS & Unvalidated Redirects and Forwards Persistent XSS : - During the instalation or configuration modification, the title field is vulnerable. e.g <script>alert(1)</script> Quotes can not be used because of var_export(), but String.fromCharCode works - The url field of a link is vulnerable : When there is no redirector : javascript:alert(1) Then, the code is triggered when a user click the url of a link Or with a classic XSS : "><script>alert(1)</script> Unvalidated Redirects and Forwards : A request with the param linksperpage or privateonly can be used to redirect a user to an arbitrary referer e.g GET /Audit/Shaarli/master-705f835/?linksperpage=10 HTTP/1.1 Host: 127.0.0.1 Referer: https://duckduckgo.com History : March 2, 2013 - Vendor contacted
* Initial commit (version 0.0.40 beta)v0.0.40betaSébastien SAUVAGE2013-02-261-0/+26
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-01 16:30:30 +0000