mirror of
https://gitlab.com/davical-project/davical.git
synced 2026-08-03 14:09:23 +00:00
ea1ca0be0c
* HTML escape the remotely retrieved version string printed to the HTML in order to prevent and attacks (if this would have been possible at all in 12 characters). The version string read from the davical.org webserver might be changed by an attacker in order to perform XSS. Even though this is highly unlikley (there are only 12 characters used) it's better to HTML escape any such string that is printed to HTML. This was originally reported at: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703290
DAViCal for Debian ---------------- This is a CalDAV Server which I wrote because I was getting sick of the length of time it was taking to make worthwhile CalDAV server-side implementations that worked OK with Evolution. Then, when I finally did find a CalDAV store that worked, I found that it was quite bloated because it wanted to do vast amounts of irrelevant stuff. Well, irrelevant for me in any case. Andrew McMillan <andrew@catalyst.net.nz>, Tue. 2 May 2006 07:11:22 +1200