forgejo-federation/docs/content
Cacciuc a31a6e3996
proper signature validation (#13523)
$header_signature could be a typed float (start with 0e and then only numbers) and a float does equal a string when comparing with typed juggle.
eg: 0e123 != "abc" does return false, but 0e123 !== "abc" returns true.

you previously could circumvent the signature check when providing a header signature in the float format (0e...)

Co-authored-by: techknowlogick <techknowlogick@gitea.io>
Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
2020-11-13 13:28:15 -05:00
..
doc proper signature validation (#13523) 2020-11-13 13:28:15 -05:00
page Add mermaid JS renderer (#12334) 2020-07-27 02:24:09 -04:00