Version 0.9.15

- Addresses XSS aspect of issue #546

htdocs/index-dev.html

@@ -113,7 +113,7 @@
 	<!-- BUILD: COMBINE_SCRIPT_END -->
 
 	<script src="/socket.io/socket.io.js"></script>
-	<script src="/api/app/config?callback=app.receiveConfig"></script>
+	<script src="/api/app/config"></script>
 
 </body>
 </html>

lib/api/config.js

@@ -15,6 +15,9 @@ module.exports = Class.create({
 		// send config to client
 		var self = this;
 
+		// prevent XSS
+		args.query.callback = 'app.receiveConfig';
+
 		// do not cache this API response
 		this.forceNoCacheResponse(args);
 

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "Cronicle",
-	"version": "0.9.14",
+	"version": "0.9.15",
 	"description": "A simple, distributed task scheduler and runner with a web based UI.",
 	"author": "Joseph Huckaby <[email protected]>",
 	"homepage": "https://github.com/jhuckaby/Cronicle",