Файл: framework/vendors/htmlpurifier/standalone/HTMLPurifier/ConfigSchema/schema/URI.MungeSecretKey.txt
Строк: 33
URI.MungeSecretKey
TYPE: string/null
VERSION: 3.1.1
DEFAULT:
NULL
--DESCRIPTION--
<p>
This directive enables secure checksum
generation along with %URI.Munge.
It should be set to a secure key that
is not shared with anyone else.
The checksum can be placed in the URI
using %t. Use of this checksum
affords an additional level of
protection by allowing a redirector
to check if a URI has passed
through HTML Purifier with this line:
</p>
<pre>$checksum ===
hash_hmac("sha256", $url, $secret_key)</pre>
<p>
If the output is TRUE, the redirector script should accept the
URI.
</p>
<p>
Please note that it would still be possible
for an attacker to procure
secure hashes en-mass by abusing your
website's Preview feature or the
like, but this service affords an
additional level of protection
that should be combined with website
blacklisting.
</p>
<p>
Remember this has no effect if
%URI.Munge is not on.
</p>
--# vim: et sw=4 sts=4