evazion c836c93b81 autocomplete: don't send cookies in publicly cached responses. ...

Fix session cookies being sent in publicly cached /autocomplete.json
responses. We can't set any cookies in a response that is being publicly
cached, otherwise they'll be visible to other users. If a user's session
cookies were to be cached, then it would allow their account to be stolen.

In reality, well-behaved caches like Cloudflare will simply refuse to
cache responses that contain cookies to avoid this scenario.

https://support.cloudflare.com/hc/en-us/articles/200172516-Understanding-Cloudflare-s-CDN:

    BYPASS is returned when enabling Origin Cache-Control. Cloudflare also
    sets BYPASS when your origin web server sends cookies in the response
    header.

2020-12-15 03:48:59 -06:00

..

factories

users: add new owner level.

2020-12-13 21:18:24 -06:00

files

media file: fix exception on empty files.

2020-06-22 18:49:36 -05:00

functional

autocomplete: don't send cookies in publicly cached responses.

2020-12-15 03:48:59 -06:00

helpers

Fix #3497: Invalid DText denial of service attack.

2018-01-14 16:14:18 -06:00

jobs

BURs: don't log mod actions for aliases/implications/mass updates.

2020-12-02 12:20:28 -06:00

mailers/previews

users: add new owner level.

2020-12-13 21:18:24 -06:00

system

post disapprovals: refactor disapproval reasons.

2020-04-03 23:44:02 -05:00

test_helpers

Update should helper with more functionality

2020-07-27 19:29:21 +00:00

unit

autocomplete: fix exception when typing "/" in autocomplete.

2020-12-14 21:57:28 -06:00

.rubocop.yml

ci: use more permissive rubocop / codeclimate settings.

2020-06-15 16:45:37 -05:00

application_system_test_case.rb

tests: skip system tests when firefox isn't installed.

2019-09-29 14:29:28 -05:00

test_helper.rb

/comments.atom: fix restricted posts being leaked.

2020-07-06 02:51:30 -05:00