gallery3.git - A clone of the Gallery3 code for testing and development.

Age	Commit message (Collapse)	Author
2013-01-21	Update copyright to 2013. Fixes #1953.	Bharat Mediratta

2012-02-27	Update copyright to 2012. #1822	Bharat Mediratta

2011-01-21	Update copyright to 2011.	Bharat Mediratta

2010-03-03	Update the copyright to 2010. It's only 3 months into the year :-)	Bharat Mediratta

2010-01-19	Extend Gallery_Unit_Test_Case instead of Unit_Test_Case.	Bharat Mediratta

2009-09-23	Correct indentation	Tim Almdal

2009-09-17	- Add theme->movie_menu() to whitelisted methods.	Andy Staudacher
	- xss_data checkpoint
2009-09-01	Remove debugging code	Andy Staudacher

2009-09-01	Fix bug in XSS scanner for <script> block @ position 0 of inline_html	Andy Staudacher

2009-08-31	Add XSS check for HTML attributes	Andy Staudacher

2009-08-31	Add XSS check to ensure that html::js_string() is not preceded by a quote.	Andy Staudacher

2009-08-31	Adding XSS test for href="javascript: and onclick="..."	Andy Staudacher

2009-08-31	Rename mark_safe() to mark_clean()	Andy Staudacher

2009-08-30	Check for href="<?= $foo ?>" (malicious "javascript:..." string)	Andy Staudacher

2009-08-30	Tabs to spaces cleanup	Andy Staudacher

2009-08-30	Rename clean_js to js_string and have it return a complete JS string (with ↵	Andy Staudacher
	delimiters) instead of just the string contents. Benefits: Using json_encode(), which is very robust. And as a user, it's clearer how to use this API compared to what it was before.
2009-08-30	Add $theme-> methods to Xss whitelist for HTML safety.	Andy Staudacher
	Updating XSS golden file.
2009-08-29	Update all code to use helper method html::clean(), html::purify(), ... ↵	Andy Staudacher
	instead of SafeString directly.
2009-08-29	Adding html::clean(), ::purify(), etc.	Andy Staudacher

2009-08-29	Undo url helper changes - url methods no longer return a SafeString.	Andy Staudacher
	Adding SafeString::of_safe_html() calls where urls are passed as parameters to t() and t2().
2009-08-29	Fixing all detected XSS vectors in PHP->JS code.	Andy Staudacher
	Xss: Rename UNKNOWN back to DIRTY, JS_XSS to DIRTY_JS. (using a different flag value to highlight potential XSS vectors in JS)
2009-08-29	Add more factory methods for convenience:	Andy Staudacher
	SafeString::purify() and SafeString::of_safe_html(). Removing SafeString::mark_html_safe() since it's no longer needed.
2009-08-29	Have url::site() and other methods return a SafeString, just as t() and t2().	Andy Staudacher
	Benefits: - url::site() is often used in views and we can ensure in the url class that returned strings are indeed safe for use in HTML. Makes the list of vars of unknown safety status shorter. - url::site() is often used as message parameter to t() and t2(). The parameter would be HTML-escaped if it wasn't marked as safe HTML already. Makes the usage simpler / shorter.
2009-08-29	Adding SafeString which is going to replace p::clean() and p::purify().	Andy Staudacher
	Refactoring of Xss_Security_Test. t() and t2() return a SafeString instance. TODO: - Update all code to use SafeString where appropriate. - Update golden fole of Xss_Security_Test - Stop reporting CLEAN vars in Xss_Security_Test
2009-07-16	Update Xss_Security_Test to know about p::purify() and checkpoint the	Bharat Mediratta
	golden file.
2009-06-05	Remove source code copy artefact	Andy Staudacher

2009-06-04	Change "CLEAN" to an empty string to see if it's better visually.	Bharat Mediratta
	Looks like it is.
2009-05-31	Update the clean/dirty format, check all ffiles instead of just one (which ↵	Bharat Mediratta
	was for debugging)
2009-05-31	First pass at an XSS security test, along with the "p" helper which	Bharat Mediratta
	can clean HTML output.