Florian Bruhin 43e58ac865 CVE-2018-10895: Fix CSRF issues with qute://settings/set URL ... In ffc29ee043 (part of v1.0.0), a qute://settings/set URL was added to change settings. Contrary to what I apparently believed at the time, it *is* possible for websites to access `qute://*` URLs (i.e., neither QtWebKit nor QtWebEngine prohibit such requests, other than the usual cross-origin rules). In other words, this means a website can e.g. have an `<img>` tag which loads a `qute://settings/set` URL, which then sets `editor.command` to a bash script. The result of that is arbitrary code execution. Fixes #4060 See #2332		2018-07-11 17:05:23 +02:00
..
http	Update copyright years	2018-02-05 12:19:50 +01:00
network	CVE-2018-10895: Fix CSRF issues with qute://settings/set URL	2018-07-11 17:05:23 +02:00
test_cache.py	Update copyright years	2018-02-05 12:19:50 +01:00
test_cookies.py	Update copyright years	2018-02-05 12:19:50 +01:00
test_downloads.py	Add a log-requests debug-flag	2018-05-07 10:23:56 +02:00
test_mhtml.py	Update copyright years	2018-02-05 12:19:50 +01:00
test_tabhistory.py	Update copyright years	2018-02-05 12:19:50 +01:00
test_webkitelem.py	Revert "Fix Qt 5.11 issues with clicking invalid links"	2018-06-07 13:49:13 +02:00