diff options
| author |  Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-03-08 19:36:39 +0100 |
|---|---|---|
| committer | Alexandre Alapetite <alexandre@alapetite.fr>
| 2016-03-08 19:36:39 +0100 |
| commit | 90117b039743a2c9c7f715d4badd94ea41160562 (patch) | |
| tree | 7d55e4daa88d602862f542092f5872e95bf99558 | |
| parent | 2d9c27549d23e20df4221ffb6a84835ba836b06a (diff) | |
| parent | c9ebbe9657b9b202817b9e0b387a584340e4e20b (diff) | |
Merge pull request #1118 from Alkarex/API-input-sanitize
API limit INPUT to 1MB
| -rw-r--r-- | CHANGELOG.md | 1 | ||||
| -rw-r--r-- | p/api/greader.php | 2 |
2 files changed, 2 insertions, 1 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index a316a1c15..233d9bdba 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ * Added CSP `Content-Security-Policy: default-src 'self'; child-src *; frame-src *; img-src * data:; media-src *` [#1075](https://github.com/FreshRSS/FreshRSS/issues/1075), [#1114](https://github.com/FreshRSS/FreshRSS/issues/1114) * Added `X-Content-Type-Options: nosniff` [#1116](https://github.com/FreshRSS/FreshRSS/pull/1116) * Cookie with `Secure` tag when used over HTTPS [#1117](https://github.com/FreshRSS/FreshRSS/pull/1117) + * Limit API post input to 1MB [#1118](https://github.com/FreshRSS/FreshRSS/pull/1118) * Features * New list of domains for which to force HTTPS (for images, videos, iframes…) defined in `./data/force-https.default.txt` and `./data/force-https.txt` [#1083](https://github.com/FreshRSS/FreshRSS/issues/1083) * In particular useful for privacy and to avoid mixed content errors, e.g. to see YouTube videos when FreshRSS is in HTTPS diff --git a/p/api/greader.php b/p/api/greader.php index 3fa367299..62782ce1a 100644 --- a/p/api/greader.php +++ b/p/api/greader.php @@ -23,7 +23,7 @@ Server-side API compatible with Google Reader API layer 2 require('../../constants.php'); require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader -$ORIGINAL_INPUT = file_get_contents('php://input'); +$ORIGINAL_INPUT = file_get_contents('php://input', false, null, -1, 1048576); if (PHP_INT_SIZE < 8) { //32-bit function dec2hex($dec) { |