Code

Security fixes#11

Code

Open

csware wants to merge 8 commits intoOleKEH:masterOleKEH/prairie-openid2-server:masterfrom csware:security-fixescsware/prairie-openid2-server:security-fixesCopy head branch name to clipboard

+96-91

Commits

Commits on Aug 7, 2014

• Use mysql_real_escape_string

  Show description for b56de02
  csware

  committed
  b56de02

  Copy full SHA for b56de02

• Cast variables to int to prevent possible injections

  Show description for dbd3a5a
  csware

  committed
  dbd3a5a

  Copy full SHA for dbd3a5a

• Do not use untrusted HTTP_REFERER for redirection

  Show description for 32a4ca1
  csware

  committed
  32a4ca1

  Copy full SHA for 32a4ca1

• Try to avoid HTTP Response Splitting

  Show description for 09eaa0d
  csware

  committed
  09eaa0d

  Copy full SHA for 09eaa0d

• Accept only valid themes

  Show description for a285950
  csware

  committed
  a285950

  Copy full SHA for a285950

• Escape all user-entered data (fixes XSS holes)

  Show description for b0c2297
  csware

  committed
  b0c2297

  Copy full SHA for b0c2297

• Do not use PHP_SELF

  Show description for 5af6b47
  csware

  committed
  5af6b47

  Copy full SHA for 5af6b47

• Optimize for SSL-only setups

  Show description for e82e524
  csware

  committed
  e82e524

  Copy full SHA for e82e524