Custom Query (420 matches)

Preventing XSS the correct way.

Based on ​https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

securitytools.cpp based on OWASP's Java ESAPI: ​http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/java/org/owasp/esapi/codecs/

Changesets:

http://trac.greenstone.org/changeset/28888

http://trac.greenstone.org/changeset/28898

http://trac.greenstone.org/changeset/28899

http://trac.greenstone.org/changeset/28909

http://trac.greenstone.org/changeset/28911

http://trac.greenstone.org/changeset/28912

http://trac.greenstone.org/changeset/28913

http://trac.greenstone.org/changeset/28930

http://trac.greenstone.org/changeset/28948

http://trac.greenstone.org/changeset/28996

Initially we tried to use the OWASP C++ package. We no longer use it because when we tried it, a lot wasn't implemented yet, so we wrote our own c++ code for just the functions we needed in the new securitytools.cpp file.

Changesets to runtime-src back when we were trying to compile the owasp-for-c++ package:

http://trac.greenstone.org/changeset/28886

http://trac.greenstone.org/changeset/28910

Fixed. Changeset: http://trac.greenstone.org/changeset/28958

Remote Greenstone 3 user authenticaton stopped working, because the code working with the DerbyWrapper had changed, and now gliserver.pl could no longer instantiate another JVM that would access the Derby DB (via the users2DBtxt.java) when wanting to check if a user authenticates. Instead, a new GS3 service has been written, Authentication.remoteAuthentication(). This is called from the authentication-ping system action URL that the new ServletRealmCheck.java pings when it is called by gliserver.pl

GTI on nzdl needed to be updated after the changes for security.

Changeset:

http://trac.greenstone.org/changeset/28973

http://trac.greenstone.org/changeset/28976

http://trac.greenstone.org/changeset/28977

http://trac.greenstone.org/changeset/28979

http://trac.greenstone.org/changeset/28991

http://trac.greenstone.org/changeset/28993

(http://trac.greenstone.org/changeset/28994 and http://trac.greenstone.org/changeset/29039 which undoes 28994)