Fossil SCM
Change the default value for the "vuln-report" setting to "block".
Commit
9dd7f23116dda15cfc38fd7bc35c6177e7feacbbe12ca0b2cf1f198a386a426d
Parent
fc8cefb6419d288…
1 file changed
+2
-2
+2
-2
| --- src/th_main.c | ||
| +++ src/th_main.c | ||
| @@ -3005,11 +3005,11 @@ | ||
| 3005 | 3005 | ** recursive calls. |
| 3006 | 3006 | */; |
| 3007 | 3007 | } |
| 3008 | 3008 | |
| 3009 | 3009 | /* |
| 3010 | -** SETTING: vuln-report width=8 default=log | |
| 3010 | +** SETTING: vuln-report width=8 default=block | |
| 3011 | 3011 | ** |
| 3012 | 3012 | ** This setting controls Fossil's behavior when it encounters a potential |
| 3013 | 3013 | ** XSS or SQL-injection vulnerability due to misuse of TH1 configuration |
| 3014 | 3014 | ** scripts. Choices are: |
| 3015 | 3015 | ** |
| @@ -3039,11 +3039,11 @@ | ||
| 3039 | 3039 | int nStr /* Length of the tainted string */ |
| 3040 | 3040 | ){ |
| 3041 | 3041 | static const char *zDisp = 0; /* Dispensation; what to do with the error */ |
| 3042 | 3042 | const char *zVulnType; /* Type of vulnerability */ |
| 3043 | 3043 | |
| 3044 | - if( zDisp==0 ) zDisp = db_get("vuln-report","log"); | |
| 3044 | + if( zDisp==0 ) zDisp = db_get("vuln-report","block"); | |
| 3045 | 3045 | if( is_false(zDisp) ) return 0; |
| 3046 | 3046 | if( strstr(zWhere,"SQL")!=0 ){ |
| 3047 | 3047 | zVulnType = "SQL-injection"; |
| 3048 | 3048 | }else{ |
| 3049 | 3049 | zVulnType = "XSS"; |
| 3050 | 3050 |
| --- src/th_main.c | |
| +++ src/th_main.c | |
| @@ -3005,11 +3005,11 @@ | |
| 3005 | ** recursive calls. |
| 3006 | */; |
| 3007 | } |
| 3008 | |
| 3009 | /* |
| 3010 | ** SETTING: vuln-report width=8 default=log |
| 3011 | ** |
| 3012 | ** This setting controls Fossil's behavior when it encounters a potential |
| 3013 | ** XSS or SQL-injection vulnerability due to misuse of TH1 configuration |
| 3014 | ** scripts. Choices are: |
| 3015 | ** |
| @@ -3039,11 +3039,11 @@ | |
| 3039 | int nStr /* Length of the tainted string */ |
| 3040 | ){ |
| 3041 | static const char *zDisp = 0; /* Dispensation; what to do with the error */ |
| 3042 | const char *zVulnType; /* Type of vulnerability */ |
| 3043 | |
| 3044 | if( zDisp==0 ) zDisp = db_get("vuln-report","log"); |
| 3045 | if( is_false(zDisp) ) return 0; |
| 3046 | if( strstr(zWhere,"SQL")!=0 ){ |
| 3047 | zVulnType = "SQL-injection"; |
| 3048 | }else{ |
| 3049 | zVulnType = "XSS"; |
| 3050 |
| --- src/th_main.c | |
| +++ src/th_main.c | |
| @@ -3005,11 +3005,11 @@ | |
| 3005 | ** recursive calls. |
| 3006 | */; |
| 3007 | } |
| 3008 | |
| 3009 | /* |
| 3010 | ** SETTING: vuln-report width=8 default=block |
| 3011 | ** |
| 3012 | ** This setting controls Fossil's behavior when it encounters a potential |
| 3013 | ** XSS or SQL-injection vulnerability due to misuse of TH1 configuration |
| 3014 | ** scripts. Choices are: |
| 3015 | ** |
| @@ -3039,11 +3039,11 @@ | |
| 3039 | int nStr /* Length of the tainted string */ |
| 3040 | ){ |
| 3041 | static const char *zDisp = 0; /* Dispensation; what to do with the error */ |
| 3042 | const char *zVulnType; /* Type of vulnerability */ |
| 3043 | |
| 3044 | if( zDisp==0 ) zDisp = db_get("vuln-report","block"); |
| 3045 | if( is_false(zDisp) ) return 0; |
| 3046 | if( strstr(zWhere,"SQL")!=0 ){ |
| 3047 | zVulnType = "SQL-injection"; |
| 3048 | }else{ |
| 3049 | zVulnType = "XSS"; |
| 3050 |