![[tokkee]](http://tokkee.org/images/avatar.png){kind=avatar}
| author | richard <richard@57a73879-2fb5-44c3-a270-3262357dd7e2> | |
| Thu, 12 Mar 2009 02:25:03 +0000 (02:25 +0000) | ||
| committer | richard <richard@57a73879-2fb5-44c3-a270-3262357dd7e2> | |
| Thu, 12 Mar 2009 02:25:03 +0000 (02:25 +0000) | ||
| commit | 0de2c5584be47b04af7b389a1812a478a302dbc6 | |
| tree | c01418ae965397174a20fd3f2c254b703c2e7474 | tree | snapshot |
| parent | a7e6e07a193dc636305fe29b683a2403d1d0b7ec | commit | diff |
Plug a number of security holes:
- EditCSV and ExportCSV altered to include permission checks
- HTTP POST required on actions which alter data
- HTML file uploads served as application/octet-stream
- New item action reject creation of new users
- Item retirement was not being controlled
Additionally include documentation of the changes and modify affected tests.
git-svn-id: http://svn.roundup-tracker.org/svnroot/roundup/roundup/trunk@4180 57a73879-2fb5-44c3-a270-3262357dd7e2
- EditCSV and ExportCSV altered to include permission checks
- HTTP POST required on actions which alter data
- HTML file uploads served as application/octet-stream
- New item action reject creation of new users
- Item retirement was not being controlled
Additionally include documentation of the changes and modify affected tests.
git-svn-id: http://svn.roundup-tracker.org/svnroot/roundup/roundup/trunk@4180 57a73879-2fb5-44c3-a270-3262357dd7e2
12 files changed: