Fix to avoid being able to bypass parent validation by passing more than 1 parent parameter or by passing parent in the query fragment instead of the query string. Ultimately we will probably need to move the parent regular expressions into the rpc validation as well so that postMessage calls will be able to be validated. This needs to be done before Firefox 3 goes GA. A simple solution may be to just skip parent validation on the server entirely and rely on it happening in js.
Fix to avoid being able to bypass parent validation by passing more than 1 parent parameter or by passing parent in the query fragment instead of the query string. Ultimately we will probably need to move the parent regular expressions into the rpc validation as well so that postMessage calls will be able to be validated. This needs to be done before Firefox 3 goes GA. A simple solution may be to just skip parent validation on the server entirely and rely on it happening in js.



git-svn-id: 3f2e04d30bd9db331bbfc569b45e7de8c0d84ef0@632712 13f79535-47bb-0310-9956-ffa450edef68

apparentlymart/shindig,apache/shindig,apache/shindig,apache/shindig,apache/shindig,apparentlymart/shindig,apparentlymart/shindig,apparentlymart/shindig,apache/shindig