XSS vulnerability in Authcache Ajax

Problem/Motivation

From the original report by @mr.baileys:

The authcache_ajax submodule seems to have a security vulnerability in that it accepts/trusts any element with class "authcache-ajax-frag" and a "data-authcache-ajax-src", and will gladly load whatever is specified in the data-authcache-ajax-src". For example, a malicious user can add the following snippet to regular content:

<a href="#" class="authcache-ajax-frag" data-authcache-ajax-src='/CHANGELOG.txt'>inject changelog</a>

which will inject the site's changelog into the content. Users can also embed external URLs this way, included external content, although this is mitigated by the fact that modern browsers will block cross-domain requests.

Proposed resolution

Do not write the front-controller URL into the markup but instead as a setting.

Remaining tasks

None.

User interface changes

None.

API changes

Authcache Ajax marup changed, sites overriding the default markup need to reproduce the changes.

Data model changes

None.