Commits on Aug 16, 2021

1. [Publication] Set Content-Type for ajax responses …

   This sets the Content-Type header for the ajax responses
   in the publication module. Because it's not explicitly
   set, PHP is defaulting to text/html. This means that, in
   the event that a user directly accesses the endpoint, the
   browser will interpret the page as HTML, not JSON, and interpret
   any data in the object as HTML tags, opening the possibility of
   an XSS attack if the an someone is tricked into accessing the
   ajax endpoint directly.
   
   The frontend isn't directly vulnerable, because the data is only
   interpreted by React.
   
   Setting the Content-Type explicitly to the correct "application/json"
   means that browsers should interpret the data correctly even if
   accessed directly, rather than interpretting HTML tags.
   
   Thanks to @0xSmiley for reporting this.

   

   driusan committed Aug 16, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 36a214b
   • Browse repository at this point

   Copy the full SHA

   36a214b View commit details

   Browse the repository at this point in the history