Joshua Tauberer a14b17794b simplify how munin-cgi-graph is called to reduce the attack surface area ... Seems like if REQUEST_METHOD is set to GET, then we can drop two redundant ways the query string is given. munin-cgi-graph itself reads the environment variables only, but its calls to Perl's CGI::param will look at the command line if REQUEST_METHOD is not used, otherwise it uses environment variables like CGI used to work. Since this is all behind admin auth anyway, there isn't a public vulnerability. #914 was opened without comment which lead me to notice the redundancy and worry about a vulnerability, before I realized this is admin-only anyway. The vulnerability was created by 6d6f3ea391. See #914. This is the v0.19b hotfix commit.		2016-08-20 11:47:44 -04:00
..
templates	some minor tweaks to the new users/aliases API documentation	2016-08-08 07:28:10 -04:00
auth.py	the control panel auth hmac message should also include the user's password so that resetting a password in the database forces that user to log in to the control panel again; also use a sha256 hmac	2015-06-06 12:38:19 +00:00
backup.py	Added a pre-backup script to complement post-backup script.	2016-05-11 10:11:16 +02:00
csr_country_codes.tsv	drop the CSR_COUNTRY setting and ask within the control panel	2015-12-26 11:48:23 -05:00
daemon.py	simplify how munin-cgi-graph is called to reduce the attack surface area	2016-08-20 11:47:44 -04:00
daily_tasks.sh	nightly status checks could fail if any domains had non-ASCII characters	2016-02-13 11:51:06 -05:00
dns_update.py	add SRV records for CardDAV/CalDAV	2016-07-31 20:53:57 -04:00
email_administrator.py	use "127.0.0.1" throughout rather than mixing use of an IP address and "localhost"	2016-05-06 09:10:38 -04:00
mail_log.py	Added received mail count to hourly activity overview in mail log management script	2016-06-10 13:08:57 +02:00
mailconfig.py	Allow files in /home/user-data/mail/mailboxes	2016-02-21 13:49:07 +01:00
ssl_certificates.py	ssl_certificates: also forgot to catch free_tls_certificates.client.RateLimited	2016-03-06 14:39:34 -05:00
status_checks.py	put the ufw status checks in the network section, add a punctuation mark, add changelog entry	2016-07-29 09:23:36 -04:00
utils.py	merge functions get_web_domains and get_default_www_redirects	2015-11-29 14:46:08 +00:00
web_update.py	provision tls certificates from the control panel	2016-01-04 18:43:16 -05:00