Commits on Sep 4, 2024

1. Unset all possible dash/underscore combinations of REMOTE_USER …

   While the backend will always see underscores, as dashes are not
   permitted in environment variables that are used to pass these along,
   the frontend should always filter all possible notations, as otherwise
   an attacker could set the "REMOTE-USER" header which gets passed as
   "REMOTE_USER" unfiltered.
   
   Do the same for REMOTE_USER_* to avoid sneaking in groups that the
   user does not belong to and other user preferences.
   This however is only a theoretical attack vector once you can't
   spoof the REMOTE_USER variable anymore.
   
   (cherry picked from commit 80f1229)

   

   evgeni committed Sep 4, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 5f988fa
   • Browse repository at this point

   Copy the full SHA

   5f988fa View commit details

   Browse the repository at this point in the history