From a6496a4e8ec80b43074f59a1f9bf2cc79a082075 Mon Sep 17 00:00:00 2001 From: Ivan Kohler Date: Sun, 23 Sep 2012 15:05:41 -0700 Subject: rt 3.8.14 --- rt/lib/RT/Interface/Web.pm | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'rt/lib/RT/Interface/Web.pm') diff --git a/rt/lib/RT/Interface/Web.pm b/rt/lib/RT/Interface/Web.pm index aafca1a75..61c06acb2 100644 --- a/rt/lib/RT/Interface/Web.pm +++ b/rt/lib/RT/Interface/Web.pm @@ -1035,6 +1035,17 @@ our %is_whitelisted_component = ( # information for the search. Because it's a straight-up read, in # addition to embedding its own auth, it's fine. '/NoAuth/rss/dhandler' => 1, + + # IE doesn't send referer in window.open() + # besides, as a harmless calendar select page, it's fine + '/Helpers/CalPopup.html' => 1, + + # While both of these can be used for denial-of-service against RT + # (construct a very inefficient query and trick lots of users into + # running them against RT) it's incredibly useful to be able to link + # to a search result or bookmark a result page. + '/Search/Results.html' => 1, + '/Search/Simple.html' => 1, ); sub IsCompCSRFWhitelisted { -- cgit v1.2.1