Tickets :: Comment on [#5307] Upgrade Prototype to 1.5.1

* Your Email Address
* Spam protection	Enter the letters below: __ .___.___._.. , / `[__ [__ \| \./ \__.[___[____\|_ \|
Comment	> imp.js.php and dimp.js.php are served as javascript, so if we don't > protect them, someone can request them remotely (assuming a user is > logged in to horde, which isn't far-fetched for these purposes) and > steal a session id embedded in the javascript. So these need to be > changed to go through the /secure trick somehow (and they can't > just call evalJson in those files - then the attacker would just > define evalJson), or inlined like I did for Kronolith and Gollem. > > > > I'm hoping to pass this off since Michael, you're more familiar with > the current js structure of dimp/imp, and frankly I'm a bit friend on > bugs at the moment. Had a bad weekend with Turba. :)
Attachment
Watch this ticket