| Age | Commit message (Collapse) | Author | Files | Lines | |
|---|---|---|---|---|---|
| 2014-10-27 | [ci skip] Switch to MIT license; close #3293 | Andrey Andreev | 1 | -14/+25 | |
| 2014-10-06 | Update a config_item() use case for the new NULL return value | Andrey Andreev | 1 | -1/+1 | |
| 2014-10-05 | config_item() to return NULL instead of FALSE for non-existing items | Andrey Andreev | 1 | -3/+3 | |
| Close #3001 Close #3232 Related: #3244 | |||||
| 2014-10-02 | stream_set_chunk_size() requires PHP 5.4 | Andrey Andreev | 1 | -1/+2 | |
| 2014-09-30 | Make sure we don't waste entropy | Andrey Andreev | 1 | -0/+1 | |
| 2014-09-28 | [ci skip] Remove references to 'PHP5' from comments | Andrey Andreev | 1 | -1/+1 | |
| 2014-09-17 | Fix a defined() check | Andrey Andreev | 1 | -1/+1 | |
| Close #3233 | |||||
| 2014-09-12 | Fix #3228 | Andrey Andreev | 1 | -2/+0 | |
| 2014-08-28 | Fix CI_Security::get_random_bytes() length validation | Andrey Andreev | 1 | -1/+1 | |
| 2014-08-27 | Add CI_Security::get_random_bytes() for CSRF & XSS token generation | Andrey Andreev | 1 | -7/+54 | |
| 2014-08-18 | [ci skip] Polish changes from PR #3176 | Andrey Andreev | 1 | -6/+6 | |
| 2014-08-18 | Alter Pull #3176 to follow discussion | caseyh | 1 | -4/+4 | |
| 2014-08-11 | CSRF whitelist supports regex | Casey Hancock | 1 | -4/+7 | |
| Signed-off-by: Casey Hancock <crh431@gmail.com> | |||||
| 2014-08-05 | Fix #3123 | Andrey Andreev | 1 | -1/+1 | |
| 2014-07-14 | Add changelog entry for CSRF status code; remove line at EOF | Kyle Valade | 1 | -1/+1 | |
| 2014-07-06 | Return 403 instead of 500 if no CSRF token given | Kyle Valade | 1 | -2/+2 | |
| Not supplying a CSRF token shouldn't return a 500 response because it isn't a server error. The response status code should definitely be in the 400's, because it's the client's fault. And it should be a 403 because the client is forbidden from making that request without the appropriate credential (the CSRF token), though the request may be otherwise valid. http://en.wikipedia.org/wiki/List_of_HTTP_status_codes | |||||
| 2014-06-29 | Fixed eof | Graham Campbell | 1 | -1/+1 | |
| 2014-06-29 | Fixed typo | Graham Campbell | 1 | -2/+2 | |
| 2014-05-23 | Fix #3057 | Andrey Andreev | 1 | -66/+62 | |
| 2014-05-06 | xss_clean is not protecting GET requests that &item=/startwithslash | Documentopia.com | 1 | -1/+1 | |
| /webacd.do?isurlact=true&entactname=/webacd.do becomes /webacd.do?isurlact=true&entactname;=/webacd.do This commit adds / to the regex to it will escape those GET requests related to issue #3030 | |||||
| 2014-03-18 | More xss_clean() improvements | Andrey Andreev | 1 | -2/+2 | |
| Issue described in https://github.com/EllisLab/CodeIgniter/issues/2667#issuecomment-37980030 + a false positive | |||||
| 2014-03-18 | Another xss_clean() improvement | Andrey Andreev | 1 | -2/+2 | |
| Fixes this: https://github.com/EllisLab/CodeIgniter/issues/2667#issuecomment-37958136 | |||||
| 2014-03-18 | xss_clean() improvement | Andrey Andreev | 1 | -4/+4 | |
| Fixes this: https://github.com/EllisLab/CodeIgniter/issues/2667#issuecomment-37819186 | |||||
| 2014-02-11 | 2013 > 2014 | darwinel | 1 | -1/+1 | |
| Update copyright notices from 2013 to 2014. And update one calendar example in user_guide from year 2013/2014 to 2014/2015. | |||||
| 2014-02-10 | CI_Security: URL-decode until possible | Andrey Andreev | 1 | -1/+5 | |
| 2014-02-10 | [ci skip] Fix a typo | Andrey Andreev | 1 | -1/+1 | |
| 2014-02-10 | CI_Security: Expect a backslash as a tag separator | Andrey Andreev | 1 | -2/+2 | |
| 2014-02-10 | CI_Security: Filter jscript, wscript, vbs, confirm, prompt the same way as ↵ | Andrey Andreev | 1 | -6/+10 | |
| javascript, alert | |||||
| 2014-01-25 | Add <math> to 'naughty' HTML elements | Andrey Andreev | 1 | -1/+1 | |
| 2014-01-25 | Previous commit caused side effects ... | Andrey Andreev | 1 | -2/+2 | |
| 2014-01-25 | Fix CI_Security::_remove_evil_attributes() being way too aggressive | Andrey Andreev | 1 | -2/+2 | |
| 2014-01-25 | Re-add 'on\w*' to evil attributes (rel #2667) | Andrey Andreev | 1 | -2/+1 | |
| 2014-01-25 | Partially fix #2667 | Andrey Andreev | 1 | -2/+8 | |
| 2014-01-24 | CI_Security: Also add <svg> to 'naughty' HTML elements | Andrey Andreev | 1 | -1/+1 | |
| 2014-01-24 | CI_Security: Add <select> and <keygen> tags to the list of 'naughty' HTML ↵ | Andrey Andreev | 1 | -1/+1 | |
| elements | |||||
| 2014-01-24 | Fix syntax errors | Andrey Andreev | 1 | -2/+2 | |
| 2014-01-24 | CI_Security: Add 'form' and 'xlink:href' to evil attributes | Andrey Andreev | 1 | -1/+1 | |
| 2014-01-24 | Add &newline; and &tab; to CI_Security:: | Andrey Andreev | 1 | -1/+3 | |
| 2014-01-22 | CI_Security::_decode_entity() to replace dangerous HTML5 entities | Andrey Andreev | 1 | -1/+19 | |
| Related to issue #2771 | |||||
| 2014-01-21 | Add <button> to the list of 'naugthy' html elements in CI_Security::xss_clean() | Andrey Andreev | 1 | -2/+2 | |
| 2014-01-20 | Fix #2729 | Andrey Andreev | 1 | -2/+3 | |
| 2014-01-18 | Fix #2829 | Andrey Andreev | 1 | -4/+4 | |
| 2014-01-07 | Fix #2268 (manually implementing PR #2269) | Andrey Andreev | 1 | -3/+3 | |
| 2013-10-18 | Eh ... preg_replace() needs a replacement | Andrey Andreev | 1 | -2/+2 | |
| 2013-10-18 | Fix issue #2681 (alternative to PR #2690) | Andrey Andreev | 1 | -2/+2 | |
| 2013-10-17 | Replace the last rand() with mt_rand() | vlakoff | 1 | -2/+2 | |
| Better entropy, faster. Also fixed a few "it's" typos. | |||||
| 2013-10-03 | partial fix #2667 | David Cox Jr | 1 | -1/+1 | |
| this fixes the ability to replace a space with a / and skip the XSS filtering | |||||
| 2013-08-04 | Rename bad chars property to filename_bad_chars, remove the setter and add ↵ | Hunter Wu | 1 | -15/+2 | |
| changelog entry | |||||
| 2013-08-03 | Make the bad filename array public in Security library | Hunter Wu | 1 | -18/+38 | |
| 2013-08-03 | Revert "Add windows filename rule as an option for upload files" | Hunter Wu | 1 | -32/+19 | |
| This reverts commit 23719ab569c9c8d6b791f65d7861daba3895ddcb. | |||||
 |
index : Filebin | |
| The software behind paste.xinu.at | Florian Pritz |
| summaryrefslogtreecommitdiffstats |