-
-
Notifications
You must be signed in to change notification settings - Fork 5.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixes possible vulnerabilities with keyword hijacking #20
Conversation
Please reopen against master. |
Quick side-note on this one, can't we use the router to check for collisions? instead of having a static (sometimes broken |
Let's go there incrementally @bkcsoft -- bugfix is important. |
Same request as @strk, we need tests 😄 ping me when it's done and I'll LG_TM and Merge 😉 |
ooh, and rebase 😒 |
Seriously @unknwon, how did you derp so hard?
Current coverage is 2.18% (diff: 0.00%)@@ master #20 diff @@
========================================
Files 31 31
Lines 7508 7508
Methods 0 0
Messages 0 0
Branches 0 0
========================================
Hits 164 164
Misses 7327 7327
Partials 17 17
|
@@ -518,7 +518,7 @@ func isUsableName(names, patterns []string, name string) error { | |||
} | |||
|
|||
func IsUsableUsername(name string) error { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This function can be tested 🙂
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wait, why does that even need testing? It's a very straightforward function.
On Fri, Nov 04, 2016 at 11:52:04AM -0700, LefsFlare wrote:
|
Then it'd be a straightforward test ?
|
LGTM |
@0xBAADF00D stop that! You can't merge prs when there are pending requests for changes!!! Otherwise I will drop the rights for that. |
ok @tboerger, I understand |
* rename utlis.go to utils.go * TreeEntry IsLink function
Hello I've encountered a problem with this patch. With last version 1.9.2, I've tried to rename an organization to "plugins" as it's its final purpose. I've got a simple error 500. I've check to on gitea.log to see a notice about reserved word without any information. And many thank to our chat as I've got a link to this PR (easier to understand my 500 error :) I see at least two problems :
Edit : New issue was opened #8072 Thank a lot |
This fixes #3700. Apparently nothing in the public/ directory is actually filtered out from possible usernames, which means we can have try.gogs.io/css as a possible username. This could be quite dangerous in terms of XSS or some other exploit.
Also @unknwon, how did you derp so hard in variable naming? reversed? really?