2e24a40d68
- Fix: Notifiable-Trait zum User-Model hinzugefuegt (behebt notify()-500er) - Installer: SMTP-Verbindungstest mit EsmtpTransport + Ueberspringen-Link - Admin: Neuer E-Mail-Tab mit SMTP-Konfiguration + Verbindungstest - Admin: Lazy Quill-Initialisierung (nur sichtbare Locale wird geladen) - Uebersetzungen: 17 neue Mail-Keys in allen 6 Sprachen Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
31 lines
978 B
Plaintext
Executable File
31 lines
978 B
Plaintext
Executable File
URI.MungeSecretKey
|
|
TYPE: string/null
|
|
VERSION: 3.1.1
|
|
DEFAULT: NULL
|
|
--DESCRIPTION--
|
|
<p>
|
|
This directive enables secure checksum generation along with %URI.Munge.
|
|
It should be set to a secure key that is not shared with anyone else.
|
|
The checksum can be placed in the URI using %t. Use of this checksum
|
|
affords an additional level of protection by allowing a redirector
|
|
to check if a URI has passed through HTML Purifier with this line:
|
|
</p>
|
|
|
|
<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre>
|
|
|
|
<p>
|
|
If the output is TRUE, the redirector script should accept the URI.
|
|
</p>
|
|
|
|
<p>
|
|
Please note that it would still be possible for an attacker to procure
|
|
secure hashes en-mass by abusing your website's Preview feature or the
|
|
like, but this service affords an additional level of protection
|
|
that should be combined with website blacklisting.
|
|
</p>
|
|
|
|
<p>
|
|
Remember this has no effect if %URI.Munge is not on.
|
|
</p>
|
|
--# vim: et sw=4 sts=4
|