e7fa1e7e44
Linkification and plugins can cause requests originating from PolyGerrit
to third-party sites. Without this policy, such requests would include a
"Referer" header that potentially reveals sensitive information in
hostnames, project names, and filenames.
Unfortunately, different browsers implement different versions of the
standard. We want to use the legacy policy name "never" so browsers that
only implement the legacy standard will comply. We use a meta tag
instead of an HTTP response header because Chrome doesn't respect legacy
policies specified outside of meta tags.
Change-Id: Ibb601742121c6d0c9122e34dda2d447a068c0913
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| com/google/gerrit | ||
| BUILD | ||
| log4j.properties | ||