upstream/mercurial-mirror Files · mercurial/templates/map-cmdline.xml

hgweb: fix trust of templates path (BC)...

hgweb: fix trust of templates path (BC) Long ago we disabled trust of the templates path with a comment describing the (insecure) behavior before the change. At some later refactor, the code was apparently changed back to match the comment, unaware that the intent of the comment was to describe the behavior to avoid. This change disables the trust and updates the comment to explicitly say not only what the old problem was, but also that it was in fact a problem and the action taken to prevent it. Impact: prior to this change, if you had a UNIX-based hgweb server where users can write hgrc files, those users could potentially read any file readable by the web server. This is marked as a backwards compatibility issue because people may have configured templates without proper trust settings. Issue spotted by Greg Szorc.

David Soria Parra - - Load All Authors

File last commit:

r13387:0be2fe6a default


                r26120:1a45e49a

3.5.1 stable

Download file

             map-cmdline.xml
        
                    20 lines
            
             | 1.6 KiB
            
                | application/xml
            
             |
                XmlLexer
            
             / mercurial / templates / map-cmdline.xml
          
                    History
                
                 |
                  Source
                 | Raw
                 |Copy content
                 |Copy permalink

        Robert Bachmann
    
Added XML output for hg log...

              r10153
            
      header = '<?xml version="1.0"?>\n<log>\n'

      footer = '</log>\n'

        David Soria Parra
    
templates: add bookmarks to command line styles

              r13387
            
      changeset = '<logentry revision="{rev}" node="{node}">\n{branches}{bookmarks}{tags}{parents}<author email="{author|email|xmlescape}">{author|person|xmlescape}</author>\n<date>{date|rfc3339date}</date>\n<msg xml:space="preserve">{desc|xmlescape}</msg>\n</logentry>\n'

      changeset_verbose = '<logentry revision="{rev}" node="{node}">\n{branches}{bookmarks}{tags}{parents}<author email="{author|email|xmlescape}">{author|person|xmlescape}</author>\n<date>{date|rfc3339date}</date>\n<msg xml:space="preserve">{desc|xmlescape}</msg>\n<paths>\n{file_adds}{file_dels}{file_mods}</paths>\n{file_copies}</logentry>\n'

      changeset_debug = '<logentry revision="{rev}" node="{node}">\n{branches}{bookmarks}{tags}{parents}<author email="{author|email|xmlescape}">{author|person|xmlescape}</author>\n<date>{date|rfc3339date}</date>\n<msg xml:space="preserve">{desc|xmlescape}</msg>\n<paths>\n{file_adds}{file_dels}{file_mods}</paths>\n{file_copies}{extras}</logentry>\n'

        Robert Bachmann
    
Added XML output for hg log...

              r10153
            
      file_add  = '<path action="A">{file_add|xmlescape}</path>\n'

      file_mod  = '<path action="M">{file_mod|xmlescape}</path>\n'

      file_del  = '<path action="R">{file_del|xmlescape}</path>\n'

      start_file_copies = '<copies>\n'

      file_copy = '<copy source="{source|xmlescape}">{name|xmlescape}</copy>\n'

      end_file_copies = '</copies>\n'

      parent = '<parent revision="{rev}" node="{node}" />\n'

      branch = '<branch>{branch|xmlescape}</branch>\n'

      tag = '<tag>{tag|xmlescape}</tag>\n'

        David Soria Parra
    
templates: add bookmarks to command line styles

              r13387
            
      bookmark = '<bookmark>{bookmark|xmlescape}</bookmark>\n'

        Robert Bachmann
    
Added output of "extras" to hg log XML output

              r10159
            
      extra = '<extra key="{key|xmlescape}">{value|xmlescape}</extra>\n'

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

Robert Bachmann Added XML output for hg log...	r10153	header = '<?xml version="1.0"?>\n<log>\n'
		footer = '</log>\n'

David Soria Parra templates: add bookmarks to command line styles	r13387	changeset = '<logentry revision="{rev}" node="{node}">\n{branches}{bookmarks}{tags}{parents}<author email="{author\|email\|xmlescape}">{author\|person\|xmlescape}</author>\n<date>{date\|rfc3339date}</date>\n<msg xml:space="preserve">{desc\|xmlescape}</msg>\n</logentry>\n'
		changeset_verbose = '<logentry revision="{rev}" node="{node}">\n{branches}{bookmarks}{tags}{parents}<author email="{author\|email\|xmlescape}">{author\|person\|xmlescape}</author>\n<date>{date\|rfc3339date}</date>\n<msg xml:space="preserve">{desc\|xmlescape}</msg>\n<paths>\n{file_adds}{file_dels}{file_mods}</paths>\n{file_copies}</logentry>\n'
		changeset_debug = '<logentry revision="{rev}" node="{node}">\n{branches}{bookmarks}{tags}{parents}<author email="{author\|email\|xmlescape}">{author\|person\|xmlescape}</author>\n<date>{date\|rfc3339date}</date>\n<msg xml:space="preserve">{desc\|xmlescape}</msg>\n<paths>\n{file_adds}{file_dels}{file_mods}</paths>\n{file_copies}{extras}</logentry>\n'
Robert Bachmann Added XML output for hg log...	r10153
		file_add = '<path action="A">{file_add\|xmlescape}</path>\n'
		file_mod = '<path action="M">{file_mod\|xmlescape}</path>\n'
		file_del = '<path action="R">{file_del\|xmlescape}</path>\n'

		start_file_copies = '<copies>\n'
		file_copy = '<copy source="{source\|xmlescape}">{name\|xmlescape}</copy>\n'
		end_file_copies = '</copies>\n'

		parent = '<parent revision="{rev}" node="{node}" />\n'
		branch = '<branch>{branch\|xmlescape}</branch>\n'
		tag = '<tag>{tag\|xmlescape}</tag>\n'
David Soria Parra templates: add bookmarks to command line styles	r13387	bookmark = '<bookmark>{bookmark\|xmlescape}</bookmark>\n'
Robert Bachmann Added output of "extras" to hg log XML output	r10159	extra = '<extra key="{key\|xmlescape}">{value\|xmlescape}</extra>\n'