Erling Ellingsen 48e0cf8479 Don't send URL in redirect body ...

If you put a CR in the redirect URL, the response splitting protection refuses to send the Location header, and the body is rendered in the browser; instant xss. It would not surprise me if some browsers ignore the Location header for less obviously broken URLs, so let's just remove the URL entirely.

2013-04-25 00:49:58 -07:00

..

base

Don't send URL in redirect body

2013-04-25 00:49:58 -07:00

eval

Rename DebuggerProxy::send, DebuggerClient::send and DebuggerClient::recv

2013-04-24 17:13:58 -07:00

ext

Rename DebuggerProxy::send, DebuggerClient::send and DebuggerClient::recv

2013-04-24 17:13:58 -07:00

ext_hhvm

Fix some cpplint errors about illegal symbols

2013-04-22 14:43:49 -07:00

tmp

Code move src/ -> hphp/

2013-02-11 02:10:41 -08:00

vm

Make cseKill tolerate temps from non-cseable instructions

2013-04-25 00:49:55 -07:00

makeall.sh

Code move src/ -> hphp/

2013-02-11 02:10:41 -08:00

Makefile

Code move src/ -> hphp/

2013-02-11 02:10:41 -08:00