)]}'
{"security-guide/ch_dashboard.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5588993f14658c0e63a49eb64127ab3800bb5863","unresolved":false,"context_lines":[{"line_number":181,"context_line":"    \u003cpara\u003eDjango has dedicated middleware for cross-site request forgery (CSRF)."},{"line_number":182,"context_line":"      For further details, see the \u003clink xlink:href\u003d\"https://docs.djangoproject.com/\"\u003e"},{"line_number":183,"context_line":"      Django documentation\u003c/link\u003e.\u003c/para\u003e"},{"line_number":184,"context_line":"    \u003cpara\u003eThe Horizon Dashboard is designed to discourage developers from"},{"line_number":185,"context_line":"      introducing cross-site scripting vulnerabilities with custom dashboards,"},{"line_number":186,"context_line":"      however it is important to audit custom dashboards as threats can be"},{"line_number":187,"context_line":"      introduced. Dashboards that utilize multiple instances of JavaScript"}],"source_content_type":"application/xml","patch_set":1,"id":"3acd31a7_61a0f643","line":184,"updated":"2015-05-04 14:58:13.000000000","message":"OpenStack dashboard - see https://wiki.openstack.org/wiki/Documentation/Conventions#Service_and_project_names","commit_id":"40337363baeeb01f2054e22e8e800b6b94a5ef86"},{"author":{"_account_id":9382,"name":"Shilla Saebi","email":"shilla.saebi@gmail.com","username":"shillasaebi"},"change_message_id":"0f9787d254cfdda478552ec8eb7fb6d106f6c451","unresolved":false,"context_lines":[{"line_number":181,"context_line":"    \u003cpara\u003eDjango has dedicated middleware for cross-site request forgery (CSRF)."},{"line_number":182,"context_line":"      For further details, see the \u003clink xlink:href\u003d\"https://docs.djangoproject.com/\"\u003e"},{"line_number":183,"context_line":"      Django documentation\u003c/link\u003e.\u003c/para\u003e"},{"line_number":184,"context_line":"    \u003cpara\u003eThe Horizon Dashboard is designed to discourage developers from"},{"line_number":185,"context_line":"      introducing cross-site scripting vulnerabilities with custom dashboards,"},{"line_number":186,"context_line":"      however it is important to audit custom dashboards as threats can be"},{"line_number":187,"context_line":"      introduced. Dashboards that utilize multiple instances of JavaScript"}],"source_content_type":"application/xml","patch_set":1,"id":"1aca2d91_92f39f0a","line":184,"in_reply_to":"1aca2d91_927cbf73","updated":"2015-05-07 05:43:20.000000000","message":"Sorry meant: OpenStack dashboard","commit_id":"40337363baeeb01f2054e22e8e800b6b94a5ef86"},{"author":{"_account_id":9382,"name":"Shilla Saebi","email":"shilla.saebi@gmail.com","username":"shillasaebi"},"change_message_id":"91e9327e6af0a9592028cacde7d2658280f214ea","unresolved":false,"context_lines":[{"line_number":181,"context_line":"    \u003cpara\u003eDjango has dedicated middleware for cross-site request forgery (CSRF)."},{"line_number":182,"context_line":"      For further details, see the \u003clink xlink:href\u003d\"https://docs.djangoproject.com/\"\u003e"},{"line_number":183,"context_line":"      Django documentation\u003c/link\u003e.\u003c/para\u003e"},{"line_number":184,"context_line":"    \u003cpara\u003eThe Horizon Dashboard is designed to discourage developers from"},{"line_number":185,"context_line":"      introducing cross-site scripting vulnerabilities with custom dashboards,"},{"line_number":186,"context_line":"      however it is important to audit custom dashboards as threats can be"},{"line_number":187,"context_line":"      introduced. Dashboards that utilize multiple instances of JavaScript"}],"source_content_type":"application/xml","patch_set":1,"id":"1aca2d91_927cbf73","line":184,"in_reply_to":"3acd31a7_61a0f643","updated":"2015-05-07 05:42:04.000000000","message":"Hi Vic, \n\nThis just needs to be changed to: The OpenStack Dashboard is designed to...","commit_id":"40337363baeeb01f2054e22e8e800b6b94a5ef86"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"5588993f14658c0e63a49eb64127ab3800bb5863","unresolved":false,"context_lines":[{"line_number":188,"context_line":"      should be audited for vulnerabilities such as inappropriate use of"},{"line_number":189,"context_line":"      the \u003cliteral\u003e@csrf_exempt\u003c/literal\u003e decorator. Any dashboard that does"},{"line_number":190,"context_line":"      not follow the recommended security settings mentioned should be"},{"line_number":191,"context_line":"      carefully evaluated.\u003c/para\u003e"},{"line_number":192,"context_line":"  \u003c/section\u003e"},{"line_number":193,"context_line":"  \u003csection xml:id\u003d\"dashboard-cookies\"\u003e"},{"line_number":194,"context_line":"    \u003ctitle\u003eCookies\u003c/title\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"3acd31a7_41ba9a6f","line":191,"updated":"2015-05-04 14:58:13.000000000","message":"Would be nice to change this to active voice and writing to the user:\n\nhttps://wiki.openstack.org/wiki/Documentation/Conventions#Writing_style","commit_id":"40337363baeeb01f2054e22e8e800b6b94a5ef86"}]}