| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
| |
Any additional URL parameters after a & were previously dropped.
|
|
|
|
|
| |
This reduces the possibility of a malicious URL redirecting to another
domain.
|
|
|
|
|
| |
The intent of this cookie isn't actually to track sessions, so eliminate
any privacy impact by using a fixed number instead.
|
| |
|
|
If an expensive request comes in from anyone without a cookie attached,
redirect to a page where the cookie is set using JavaScript, then
redirect back. This should block robots from these paths, most of which
do not support JavaScript. The collateral damage is that a JavaScript
browser is now required for users to access those paths. The contents
of the cookie is not currently checked, merely that it is set.
|