{"action":"created","issue":{"url":"https://api.github.com/repos/webasyst/webasyst-framework/issues/80","labels_url":"https://api.github.com/repos/webasyst/webasyst-framework/issues/80/labels{/name}","comments_url":"https://api.github.com/repos/webasyst/webasyst-framework/issues/80/comments","events_url":"https://api.github.com/repos/webasyst/webasyst-framework/issues/80/events","html_url":"https://github.com/webasyst/webasyst-framework/pull/80","id":54428194,"number":80,"title":"Исправление бага с csrf","user":{"login":"alexsergin","id":2052165,"avatar_url":"https://avatars.githubusercontent.com/u/2052165?v=3","gravatar_id":"","url":"https://api.github.com/users/alexsergin","html_url":"https://github.com/alexsergin","followers_url":"https://api.github.com/users/alexsergin/followers","following_url":"https://api.github.com/users/alexsergin/following{/other_user}","gists_url":"https://api.github.com/users/alexsergin/gists{/gist_id}","starred_url":"https://api.github.com/users/alexsergin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexsergin/subscriptions","organizations_url":"https://api.github.com/users/alexsergin/orgs","repos_url":"https://api.github.com/users/alexsergin/repos","events_url":"https://api.github.com/users/alexsergin/events{/privacy}","received_events_url":"https://api.github.com/users/alexsergin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-01-15T09:28:50Z","updated_at":"2015-01-16T20:26:32Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/webasyst/webasyst-framework/pulls/80","html_url":"https://github.com/webasyst/webasyst-framework/pull/80","diff_url":"https://github.com/webasyst/webasyst-framework/pull/80.diff","patch_url":"https://github.com/webasyst/webasyst-framework/pull/80.patch"},"body":"Иногда в cookie _csrf попадала кавычка, что в дальнейшем ломало некоторые шаблоны и блокировало обновление профиля.\r\nСделал экранирование."},"comment":{"url":"https://api.github.com/repos/webasyst/webasyst-framework/issues/comments/70316829","html_url":"https://github.com/webasyst/webasyst-framework/pull/80#issuecomment-70316829","issue_url":"https://api.github.com/repos/webasyst/webasyst-framework/issues/80","id":70316829,"user":{"login":"alexsergin","id":2052165,"avatar_url":"https://avatars.githubusercontent.com/u/2052165?v=3","gravatar_id":"","url":"https://api.github.com/users/alexsergin","html_url":"https://github.com/alexsergin","followers_url":"https://api.github.com/users/alexsergin/followers","following_url":"https://api.github.com/users/alexsergin/following{/other_user}","gists_url":"https://api.github.com/users/alexsergin/gists{/gist_id}","starred_url":"https://api.github.com/users/alexsergin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexsergin/subscriptions","organizations_url":"https://api.github.com/users/alexsergin/orgs","repos_url":"https://api.github.com/users/alexsergin/repos","events_url":"https://api.github.com/users/alexsergin/events{/privacy}","received_events_url":"https://api.github.com/users/alexsergin/received_events","type":"User","site_admin":false},"created_at":"2015-01-16T20:26:32Z","updated_at":"2015-01-16T20:26:32Z","body":"@alexmuz очень странный подход считать что сторонние разработчики должны позаботиться об отсутствии конфликтов с вашим продуктом, а самому при этом не заботиться об отсутствии конфликтов в своем продукте с другими. CSRF это стандарт, и выводя его значение в аттрибуте тэга его правильно обрабатывать в любом случае.\r\n\r\nПри этом зачастую пользователи могут поставить продукт в поддиректорию и не иметь возможности управлять тем как и куда ставится кука. В данном случае например. Yii ведь достаточно большой и мощный фреймворк и проектов на нем куча, но тем не менее как видите по дефолту он вешает куку на весь домен. Хотя надо отдать должное - обрабатывает ее значение в аттрибутах тэка хоть кавычки и попадаются."}}