From c050ce7de2091f580bf85ab367d9c7f5cb26f44c Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Fri, 25 Apr 2014 10:27:13 -0400 Subject: [PATCH] [1.7.x] Fixed #22504 -- Corrected domain terminology in security guide. Thanks chris at chrullrich.net. Backport of f65eb15ac6 from master --- docs/topics/security.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/topics/security.txt b/docs/topics/security.txt index 5fd62eb694..b30d340b02 100644 --- a/docs/topics/security.txt +++ b/docs/topics/security.txt @@ -237,11 +237,11 @@ User-uploaded content you can take to mitigate these attacks: 1. One class of attacks can be prevented by always serving user uploaded - content from a distinct Top Level Domain (TLD). This prevents any - exploit blocked by `same-origin policy`_ protections such as cross site - scripting. For example, if your site runs on ``example.com``, you would - want to serve uploaded content (the :setting:`MEDIA_URL` setting) from - something like ``usercontent-example.com``. It's *not* sufficient to + content from a distinct top-level or second-level domain. This prevents + any exploit blocked by `same-origin policy`_ protections such as cross + site scripting. For example, if your site runs on ``example.com``, you + would want to serve uploaded content (the :setting:`MEDIA_URL` setting) + from something like ``usercontent-example.com``. It's *not* sufficient to serve content from a subdomain like ``usercontent.example.com``. 2. Beyond this, applications may choose to define a whitelist of allowable