revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-11-27 01:02:42 +01:00
Code Issues Releases Wiki Activity
No description
9461 commits 3 branches 7 tags 153 MiB
PHP 93.5%
JavaScript 4.1%
CSS 2.4%
Find a file
epriestley ac029d0a50 Fix a self-XSS hole in Diffusion 
Summary:
Via HackerOne. We aren't correctly escaping the date, so a user can XSS themselves by setting their date format creatively.

This construction is very unusual and I don't think we do anything similar elsewhere, so I can't come up with a systematic change which would prevent this in the general case.

Test Plan: Set date format to tag junk, got self-XSS before patch and proper escaping after the patch.

Reviewers: btrahan, chad

Reviewed By: chad

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D12117
2015-03-20 14:54:35 -07:00
bin Add some of a billing daemon skeleton 2015-01-30 11:29:05 -08:00
conf Add bin/almanac register to associate a host with an Almanac device and trust it 2015-01-02 15:13:30 -08:00
externals Remove support for Balanced payments 2015-03-13 15:47:37 -07:00
resources Conpherence - add storage for view / edit / join policy 2015-03-17 17:04:44 -07:00
scripts Pass overseer configuration over stdin 2015-02-24 14:50:30 -08:00
src Fix a self-XSS hole in Diffusion 2015-03-20 14:54:35 -07:00
support Namespace Aphlict clients by request path, plus other fixes 2015-02-16 11:31:15 -08:00
webroot Conpherence - fix a typo 2015-03-17 17:01:33 -07:00
.arcconfig Update .arclint in Phabricator for phutil-library lint 2014-05-12 06:01:30 -07:00
.arclint Fix text lint issues 2015-02-12 07:00:13 +11:00
.editorconfig Fix text lint issues 2015-02-12 07:00:13 +11:00
.gitignore When registering a device, write a device ID 2015-01-22 16:06:04 -08:00
LICENSE Fix text lint issues 2015-02-12 07:00:13 +11:00
NOTICE Update Phabricator NOTICE file to reflect modern legal circumstances 2014-06-25 13:42:13 -07:00
README.md Marginal improvements to README 2015-03-08 11:29:06 -07:00

README.md

Phabricator is an open source collection of web applications which help software companies build better software.

Phabricator includes applications for:

  • reviewing and auditing source code;
  • hosting and browsing repositories;
  • tracking bugs;
  • managing projects;
  • conversing with team members;
  • assembling a party to venture forth;
  • writing stuff down and reading it later;
  • hiding stuff from coworkers; and
  • also some other things.

You can learn more about the project (and find links to documentation and resources) at Phabricator.org

Phabricator is developed and maintained by Phacility.

BUG REPORTS

Please update your install to HEAD before filing bug reports. Follow our bug reporting guide for complete instructions.

FEATURE REQUESTS

We're big fans of feature requests that state core problems, not just 'add this'. We've compiled a short guide to effective upstream requests here.

COMMUNITY CHAT

Please visit our IRC Channel (#phabricator on FreeNode) to talk with other members of the Phabricator community. There might be someone there who can help you with setup issues or what image to choose for a macro.

SECURITY ISSUES

Phabricator participates in HackerOne and may pay out for various issues reported there. You can find out more information on our HackerOne page.

PULL REQUESTS

We do not accept pull requests through GitHub. If you would like to contribute code, please read our Contributor's Guide for more information.

LICENSE

Phabricator is released under the Apache 2.0 license except as otherwise noted.