You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
30 lines
978 B
30 lines
978 B
URI.MungeSecretKey |
|
TYPE: string/null |
|
VERSION: 3.1.1 |
|
DEFAULT: NULL |
|
--DESCRIPTION-- |
|
<p> |
|
This directive enables secure checksum generation along with %URI.Munge. |
|
It should be set to a secure key that is not shared with anyone else. |
|
The checksum can be placed in the URI using %t. Use of this checksum |
|
affords an additional level of protection by allowing a redirector |
|
to check if a URI has passed through HTML Purifier with this line: |
|
</p> |
|
|
|
<pre>$checksum === hash_hmac("sha256", $url, $secret_key)</pre> |
|
|
|
<p> |
|
If the output is TRUE, the redirector script should accept the URI. |
|
</p> |
|
|
|
<p> |
|
Please note that it would still be possible for an attacker to procure |
|
secure hashes en-mass by abusing your website's Preview feature or the |
|
like, but this service affords an additional level of protection |
|
that should be combined with website blacklisting. |
|
</p> |
|
|
|
<p> |
|
Remember this has no effect if %URI.Munge is not on. |
|
</p> |
|
--# vim: et sw=4 sts=4
|
|
|