Noting that #1839341 does resolve the second bullet point in Jason's original bug report. The first one still remains to be fixed (removing the pcrud controller from the coustl class in the IDL).
If we'd like to backport the fix -- and I think we should -- we would need to modify the dojo interface to use Kyle's new API. Additionally, when the new Angular UI is merged, we should either include the updated dojo that uses the new UI, or remove the dojo history interface completely. It wouldn't do much good to keep the old (insecure) UI around.
Noting that #1839341 does resolve the second bullet point in Jason's original bug report. The first one still remains to be fixed (removing the pcrud controller from the coustl class in the IDL).
If we'd like to backport the fix -- and I think we should -- we would need to modify the dojo interface to use Kyle's new API. Additionally, when the new Angular UI is merged, we should either include the updated dojo that uses the new UI, or remove the dojo history interface completely. It wouldn't do much good to keep the old (insecure) UI around.