2 commits

Author	SHA1	Message	Date
epriestley	c8b4bfdcd1	Encode "<" and ">" in JSON/Ajax responses to prevent content-sniffing attacks ... Summary: Some browsers will still sniff content types even with "Content-Type" and "X-Content-Type-Options: nosniff". Encode "<" and ">" to prevent them from sniffing the content as HTML. See T865. Also unified some of the code on this pathway. Test Plan: Verified Opera no longer sniffs the Conduit response into HTML for the test case in T865. Unit tests pass. Reviewers: cbg, btrahan Reviewed By: cbg CC: aran, epriestley Maniphest Tasks: T139, T865 Differential Revision: https://secure.phabricator.com/D1606	2012-02-14 14:51:51 -08:00
Bob Trahan	cf61f0e32d	Adding an "ssh" client for conduit ... Summary: ..."ssh" is in quotes 'cuz this is step 1 and there's no ssh in sight at the moment. Test Plan: ran api.php PHID-USER-xee4ju2teq7mflitwfcs differential.query a few times... - tried valid input, it worked! - tried bad input, it worked in that it failed and told me so! ran api.php crap_user differential.query a few times... - verified error message with respect to crap_user ran api.php PHID-USER-xee4ju2teq7mflitwfcs crap_method a few times... - verified error message with respect to crap_method visited http://phabricator.dev/conduit/method/differential.query a few times... - tried valid input, it worked! Reviewers: epriestley Reviewed By: epriestley CC: aran, btrahan, epriestley Maniphest Tasks: T550 Differential Revision: https://secure.phabricator.com/D1357	2012-01-13 11:54:13 -08:00