summaryrefslogtreecommitdiffstats
path: root/system
AgeCommit message (Collapse)AuthorFilesLines
2015-11-24Use PHP7's random_bytes() when possibleAndrey Andreev2-0/+21
Close #4260
2015-11-24[ci skip] Remove some redundant code from DB_forgeAndrey Andreev1-4/+0
2015-11-16[ci skip] Fix #4245Andrey Andreev1-1/+1
2015-11-16Fix #4244Andrey Andreev1-3/+28
2015-11-09Merge pull request #4223 from j0inty/developAndrey Andreev1-1/+4
CI_DB_driver->simple_query() to check initialize() return value
2015-11-09[ci skip] Fix an infinite loop in captcha helperAndrey Andreev1-1/+2
2015-11-09Merge pull request #4217 from natesilva/fix-ipv6-base_urlAndrey Andreev1-1/+10
Build base_url correctly if SERVER_ADDR is IPv6
2015-11-04[ci skip] Fix a false default-fallback bug in set_checkbox(), set_radio()Andrey Andreev1-8/+33
Relevant: #4210
2015-11-04Fix #4212Andrey Andreev1-1/+1
2015-11-04[ci skip] Start of 3.0.4 developmentAndrey Andreev1-1/+1
2015-10-31[ci skip] Update changelog, version & upgrade instructionsAndrey Andreev1-1/+1
2015-10-31Use proper randomness when generating CAPTCHAsAndrey Andreev1-2/+87
2015-10-31Prevent Host header injectionsAndrey Andreev1-4/+2
2015-10-31Harden xss_clean()Andrey Andreev1-27/+39
2015-10-30Fix #4192Andrey Andreev1-5/+8
2015-10-30Fix #3201Andrey Andreev1-1/+6
2015-10-19Fix #4171 and a number of other transaction bugsAndrey Andreev13-354/+162
2015-10-19Fix #4173Andrey Andreev1-1/+7
This reverts commit 7cc6cea2d421862726081a39e932dbceeefcc775 from PR #3968. At the time this seemed logical, but turns out it breaks the ability to create non-PRIMARY composite keys, so ...
2015-10-18Fix #4179Andrey Andreev1-0/+4
2015-10-13[ci skip] Fix #4170Andrey Andreev1-3/+1
2015-10-12[ci skip] This is 3.0.3-devAndrey Andreev1-1/+1
2015-10-12Optimize csv_from_result speed.Ahmad Anbar1-2/+3
2015-10-08[ci skip] Prepare 3.0.2 releaseAndrey Andreev1-1/+1
2015-10-05Some more intrusive XSS cleaningAndrey Andreev1-5/+11
2015-10-05Close #4155Andrey Andreev1-1/+1
2015-10-02More XSS stuffAndrey Andreev1-1/+1
2015-09-29Merge pull request #4126 from zoaked/patch-1Andrey Andreev1-1/+0
Persist config file rules when using FV reset_validation()
2015-09-24Fix #4137Andrey Andreev1-1/+1
2015-09-21More XSS stuffAndrey Andreev1-3/+3
2015-09-17Don't allow open-ended tags to pass through xss_clean()Andrey Andreev1-4/+9
This was a regression caused by the previous commit
2015-09-17Refactor 'evil attributes' sanitization logicAndrey Andreev1-92/+66
Turned out pretty much impossible to do remove 'evil attributes' with just one pattern - it either breaks something else, hits pcre.backtrack_limit or causes PHP to segfault. No benchmarks made, but there shouldn't be any performance regressions since we're now trying to strip attributes only after it is determined that they are inside a tag; up until now this was done seprately for _sanitize_naughty_html() and _remove_evil_attributes().
2015-09-16Fix #4116Andrey Andreev1-6/+6
Close #4117
2015-09-16Fix #4120Andrey Andreev1-3/+13
2015-09-15Missing character in the evil attributes patternAndrey Andreev1-1/+1
2015-09-14Another addition to tag detection patterns in xss_clean()Andrey Andreev1-1/+4
2015-09-14Close #4098Andrey Andreev1-2/+18
2015-09-14Fix #4032Andrey Andreev1-5/+8
2015-09-14Fix #4044Andrey Andreev1-5/+5
2015-09-14Fix #4109Andrey Andreev1-20/+22
2015-09-14Add 'eval' to a JS blacklist in xss_clean()Andrey Andreev1-7/+10
2015-09-14Move _remove_evil_attributes() callAndrey Andreev1-4/+3
2015-09-11Harden xss_clean() moreAndrey Andreev1-5/+37
This time eliminate false positives for the 'naughty html' logic.
2015-09-11Improve on previous commitAndrey Andreev1-1/+1
2015-09-11Replace the latest XSS patchesAndrey Andreev1-9/+21
This one fixes yet another issue, is cleaner and faster.
2015-09-10Last commit didn't adjust a RE indexAndrey Andreev1-1/+1
2015-09-10Fix & extend 700619cebf75c4e4fcda6a2d7bea1afb84a029e4Andrey Andreev1-2/+2
2015-09-10Change form validation library to allow the pipe character within square ↵rich1-1/+1
brackets
2015-09-10Fix #4106Andrey Andreev1-2/+2
2015-09-07Remove unnecessary count() calls from _sanitize_globals()Andrey Andreev1-3/+3
foreach() just won't execute for an empty array, it does that check internally.
2015-09-07Move csrf_verify() call out of _sanitize_globals()Andrey Andreev1-6/+6
It doesn't belong in there.