Bug css url signing does not protect all arguments

  • Thread starter Thread starter Xon
  • Start date Start date
There is a bug in this version
X

Xon

Guest
XF url signs the autogenerated css.php links, however only covers the css argument and not the language/style/last modified arguments. It is also optional, so it can be completely trimmed off.

If url signing is going to be used it should cover all the style related arguments, and likely not be optional in non-debug mode.

Continue reading...
 
You must log in or register to reply here.
Top Bottom
Back