1. 05 Jun, 2015 2 commits
    • Fix a possible security issue with spoofing · 9aee4112
      Thanks to MORI Shingo of DeNA Co., Ltd. for reporting this.
      
      There is an issue where if an HTML file is uploaded with a .html
      extension, but the content type is listed as being `image/jpeg`, this
      will bypass a validation checking for images. But it will also pass the
      spoof check, because a file named .html and containing actual HTML
      passes the spoof check.
      
      This change makes it so that we also check the supplied content type. So
      even if the file contains HTML and ends with .html, it doesn't match the
      content type of `image/jpeg` and so it fails.
      Jon Yurek committed
  2. 09 Dec, 2014 1 commit
  3. 08 Dec, 2014 1 commit
  4. 14 Nov, 2014 1 commit
  5. 07 Nov, 2014 1 commit
  6. 24 Oct, 2014 2 commits
  7. 25 Sep, 2014 1 commit
  8. 15 Sep, 2014 3 commits
  9. 13 Sep, 2014 3 commits
  10. 12 Sep, 2014 2 commits
  11. 04 Sep, 2014 2 commits
  12. 30 Aug, 2014 4 commits
  13. 29 Aug, 2014 7 commits
  14. 26 Aug, 2014 1 commit
  15. 07 Aug, 2014 1 commit
  16. 02 Aug, 2014 1 commit
  17. 30 Jul, 2014 1 commit
  18. 08 Jul, 2014 5 commits
  19. 20 Jun, 2014 1 commit