| fc6b11d2 | 26-Jan-2020 |
Michael Große <mic.grosse@googlemail.com> |
Add feature flag for deferred javascript
This adds a feature flag for the jQuery and main-js requests added in
#2786 and #2958. This adds only a single feature flag since deferring
jQuery without d
Add feature flag for deferred javascript
This adds a feature flag for the jQuery and main-js requests added in
#2786 and #2958. This adds only a single feature flag since deferring
jQuery without deferring the main javascript request is likely to cause
errors and confusion.
The feature flag defaults to "on" as this should be unproblematic except
for a few plugins. Also, with this flag being on by default, it should
see more usage and is more likely to uncover existing issues.
This feature flag should be removed once this feature is deemed safe.
show more ...
|
| 925105e8 | 21-Oct-2019 |
Phy <git@phy25.com> |
clientIP: add trustedproxy, return first untrusted IP instead of the last one
This fixes #2828, where malicious clients passed in customized HTTP header to keep its IP address off records.
This is
clientIP: add trustedproxy, return first untrusted IP instead of the last one
This fixes #2828, where malicious clients passed in customized HTTP header to keep its IP address off records.
This is inspired by Sympony's Request::setTrustedProxies, but I don't want to implement everything including IP CIDR matching (IPv4 + IPv6), so I decided to reuse the local IP checker in place powered by regexp. Now admins can customize this "local" (trusted) proxy list using $conf['trustedproxy'], and by default it will allow any local IPs.
If in the future there is a need to implement array-based CIDR matching, $conf['trustedproxies'] can be used for the new config name.
show more ...
|