Closed css url signing does not protect all arguments

X

Xon

Well-known member
Licensed customer
Affected version
2.2.15
XF url signs the autogenerated css.php links, however only covers the css argument and not the language/style/last modified arguments. It is also optional, so it can be completely trimmed off.

If url signing is going to be used it should cover all the style related arguments, and likely not be optional in non-debug mode.
 
Automated triage: As designed

Thank you for reporting this issue. The key on combined CSS URLs only decides whether the output may be written to the server's CSS cache. A request with no key or a wrong key is still served, from the cache if an entry already exists, but can't add a new one. The style and language values can only select ones that exist, and the date value is just a cache-buster the server doesn't read.

This is an automated assessment. A member of staff may review and update it.
 
Back
Top Bottom