Florian Bruhin 43e58ac865 CVE-2018-10895: Fix CSRF issues with qute://settings/set URL ... In ffc29ee043 (part of v1.0.0), a qute://settings/set URL was added to change settings. Contrary to what I apparently believed at the time, it *is* possible for websites to access `qute://*` URLs (i.e., neither QtWebKit nor QtWebEngine prohibit such requests, other than the usual cross-origin rules). In other words, this means a website can e.g. have an `<img>` tag which loads a `qute://settings/set` URL, which then sets `editor.command` to a bash script. The result of that is arbitrary code execution. Fixes #4060 See #2332		2018-07-11 17:05:23 +02:00
..
hello.txt.html	Clean up end2end test file structure	2016-05-29 18:20:00 +02:00
jseval_file.js	Adds a --file flag to :jseval	2017-02-25 13:11:53 +00:00
jseval.html	Add missing jseval.html	2016-09-12 20:02:03 +02:00
pyeval_file.py	Update copyright years	2018-02-05 12:19:50 +01:00
qutescheme_csrf.html	CVE-2018-10895: Fix CSRF issues with qute://settings/set URL	2018-07-11 17:05:23 +02:00
test.pdf	Clean up end2end test file structure	2016-05-29 18:20:00 +02:00