Merge pull request #481 from wallabag/dev1.5.2

1.5.2

1 files changed, 30 insertions, 0 deletions

diff --git a/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt b/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
new file mode 100644
index 00000000..123b6e26
--- /dev/null
+++ b/inc/3rdparty/htmlpurifier/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
@@ -0,0 +1,30 @@
+URI.MungeSecretKey

+TYPE: string/null

+VERSION: 3.1.1

+DEFAULT: NULL

+--DESCRIPTION--

+<p>

+    This directive enables secure checksum generation along with %URI.Munge.

+    It should be set to a secure key that is not shared with anyone else.

+    The checksum can be placed in the URI using %t. Use of this checksum

+    affords an additional level of protection by allowing a redirector

+    to check if a URI has passed through HTML Purifier with this line:

+</p>

+

+<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre>

+

+<p>

+    If the output is TRUE, the redirector script should accept the URI.

+</p>

+

+<p>

+    Please note that it would still be possible for an attacker to procure

+    secure hashes en-mass by abusing your website's Preview feature or the

+    like, but this service affords an additional level of protection

+    that should be combined with website blacklisting.

+</p>

+

+<p>

+    Remember this has no effect if %URI.Munge is not on.

+</p>

+--# vim: et sw=4 sts=4