Commit Graph

3 Commits

Author SHA1 Message Date
Michael Eischer
228d5f6051 Reword changelogs 2022-02-10 19:48:44 +01:00
Konrad Wojas
83e78c6cd7 Allow numbers in htpasswd usernames 2021-01-05 00:08:26 +08:00
Juergen Hoetzel
33c41b55bb Security: Prevent loading of usernames containing a slash
"/" is valid char in HTTP authorization headers, but is also used in
rest-server to map usernames to private repos.

This commit prevents loading maliciously composed usernames like
"/foo/config" by restricting the allowed characters to the unicode
character class, numbers, "-", "." and "@".

Closes #131
2020-12-28 11:30:00 +01:00