epriestley 68c30e1a71 Provide a setting which forces all file views to be served from an alternate ... domain Summary: See D758, D759. - Provide a strongly recommended setting which permits configuration of an alternate domain. - Lock cookies down better: set them on the exact domain, and use SSL-only if the configuration is HTTPS. - Prevent Phabriator from setting cookies on other domains. This assumes D759 will land, it is not effective without that change. Test Plan: - Attempted to login from a different domain and was rejected. - Logged out, logged back in normally. - Put install in setup mode and verified it revealed a warning. - Configured an alterate domain. - Tried to view an image with an old URI, got a 400. - Went to /files/ and verified links rendered to the alternate domain. - Viewed an alternate domain file. - Tried to view an alternate domain file without the secret key, got a 404. Reviewers: andrewjcg, erling, aran, tuomaspelkonen, jungejason, codeblock CC: aran Differential Revision: 760		2011-08-16 13:21:46 -07:00
..
aphront	Provide a setting which forces all file views to be served from an alternate	2011-08-16 13:21:46 -07:00
applications	Provide a setting which forces all file views to be served from an alternate	2011-08-16 13:21:46 -07:00
docs	Tweak Maniphest custom fields	2011-08-15 08:39:18 -07:00
infrastructure	Provide a setting which forces all file views to be served from an alternate	2011-08-16 13:21:46 -07:00
storage	Add a little more unit test documentation, fail loudly when isolation prevents a	2011-08-03 09:15:43 -07:00
view	Prevent CSRF uploads via /file/dropupload/	2011-08-16 13:19:10 -07:00
__celerity_resource_map__.php	Prevent CSRF uploads via /file/dropupload/	2011-08-16 13:19:10 -07:00
__phutil_library_init__.php	Distinguish between aphront and phabricator.	2011-01-22 17:45:28 -08:00
__phutil_library_map__.php	Provide a setting which forces all file views to be served from an alternate	2011-08-16 13:21:46 -07:00