##// END OF EJS Templates
subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC)...
subrepo: set GIT_ALLOW_PROTOCOL to limit git clone protocols (SEC) CVE-2016-3068 (1/1) Git's git-remote-ext remote helper provides an ext:: URL scheme that allows running arbitrary shell commands. This feature allows implementing simple git smart transports with a single shell shell command. However, git submodules could clone arbitrary URLs specified in the .gitmodules file. This was reported as CVE-2015-7545 and fixed in git v2.6.1. However, if a user directly clones a malicious ext URL, the git client will still run arbitrary shell commands. Mercurial is similarly effected. Mercurial allows specifying git repositories as subrepositories. Git ext:: URLs can be specified as Mercurial subrepositories allowing arbitrary shell commands to be run on `hg clone ...`. The Mercurial community would like to thank Blake Burkhart for reporting this issue. The description of the issue is copied from Blake's report. This commit changes submodules to pass the GIT_ALLOW_PROTOCOL env variable to git commands with the same list of allowed protocols that git submodule is using. When the GIT_ALLOW_PROTOCOL env variable is already set, we just pass it to git without modifications.

File last commit:

r27913:91ac8cb7 stable
r28658:34d43cb8 stable
Show More
graph.tmpl
138 lines | 4.3 KiB | application/x-cheetah | CheetahLexer
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 {header}
<title>{repo|escape}: revision graph</title>
<link rel="alternate" type="application/atom+xml"
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 href="{url|urlescape}atom-log" title="Atom feed for {repo|escape}: log" />
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 <link rel="alternate" type="application/rss+xml"
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 href="{url|urlescape}rss-log" title="RSS feed for {repo|escape}: log" />
<!--[if IE]><script type="text/javascript" src="{staticurl|urlescape}excanvas.js"></script><![endif]-->
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </head>
<body>
<div class="container">
<div class="menu">
<div class="logo">
Steven Stallion
hgweb: support alternate logo url...
r13964 <a href="{logourl}">
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 <img src="{staticurl|urlescape}{logoimg}" alt="mercurial" /></a>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </div>
<ul>
av6
hgweb: don't dereference symbolic revision in paper & coal style (issue2296)...
r25606 <li><a href="{url|urlescape}shortlog/{symrev}{sessionvars%urlparameter}">log</a></li>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 <li class="active">graph</li>
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 <li><a href="{url|urlescape}tags{sessionvars%urlparameter}">tags</a></li>
<li><a href="{url|urlescape}bookmarks{sessionvars%urlparameter}">bookmarks</a></li>
<li><a href="{url|urlescape}branches{sessionvars%urlparameter}">branches</a></li>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </ul>
<ul>
av6
hgweb: don't dereference symbolic revision in paper & coal style (issue2296)...
r25606 <li><a href="{url|urlescape}rev/{symrev}{sessionvars%urlparameter}">changeset</a></li>
<li><a href="{url|urlescape}file/{symrev}{path|urlescape}{sessionvars%urlparameter}">browse</a></li>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </ul>
Augie Fackler
web: add a help view for getting hg help output
r12666 <ul>
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 <li><a href="{url|urlescape}help{sessionvars%urlparameter}">help</a></li>
Augie Fackler
web: add a help view for getting hg help output
r12666 </ul>
Angel Ezquerra
hgweb: add (Atom) subscribe link to the main paper template pages...
r18200 <div class="atom-logo">
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 <a href="{url|urlescape}atom-log" title="subscribe to atom feed">
Anton Shestakov
hgweb: close <img> elements...
r23830 <img class="atom-logo" src="{staticurl|urlescape}feed-icon-14x14.png" alt="atom feed" />
Angel Ezquerra
hgweb: add (Atom) subscribe link to the main paper template pages...
r18200 </a>
</div>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </div>
<div class="main">
Angel Ezquerra <angel.ezquerra at gmail.com>
hgweb: add a "URL breadcrumb" to the index and repository pages...
r18258 <h2 class="breadcrumb"><a href="/">Mercurial</a> {pathdef%breadcrumb}</h2>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 <h3>graph</h3>
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 <form class="search" action="{url|urlescape}log">
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 {sessionvars%hiddenformentry}
<p><input name="rev" id="search1" type="text" size="30" /></p>
Alexander Plavin
paper: define searchhint message in map file and use it in other templates
r19795 <div id="hint">{searchhint}</div>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </form>
<div class="navigate">
av6
hgweb: don't dereference symbolic revision in paper & coal style (issue2296)...
r25606 <a href="{url|urlescape}graph/{symrev}{lessvars%urlparameter}">less</a>
<a href="{url|urlescape}graph/{symrev}{morevars%urlparameter}">more</a>
Nicolas Dumazet
hgweb: changenav: separate pages before and after the current position...
r10254 | rev {rev}: {changenav%navgraph}
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </div>
<noscript><p>The revision graph only works with JavaScript-enabled browsers.</p></noscript>
<div id="wrapper">
Alexander Plavin
hgweb: make stripes in graph with CSS
r19453 <ul id="nodebgs" class="stripes2"></ul>
FUJIWARA Katsunori
templates: use canvaswidth instead of fixed width for canvas (issue2683)...
r27913 <canvas id="graph" width="{canvaswidth}" height="{canvasheight}"></canvas>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 <ul id="graphnodes"></ul>
</div>
<script type="text/javascript">
<!-- hide script content
var data = {jsdata|json};
var graph = new Graph();
graph.scale({bg_height});
Matt Mackall
templates: escape javascript braces
r10856 graph.vertex = function(x, y, color, parity, cur) \{
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999
this.ctx.beginPath();
color = this.setColor(color, 0.25, 0.75);
this.ctx.arc(x, y, radius, 0, Math.PI * 2, true);
this.ctx.fill();
Alexander Plavin
hgweb: make stripes in graph with CSS
r19453 var bg = '<li class="bg"></li>';
Tim Delaney
hgweb: fix incorrect graph padding calculation (issue3626)...
r17580 var left = (this.bg_height - this.box_size) + (this.columns + 1) * this.box_size;
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 var nstyle = 'padding-left: ' + left + 'px;';
var tagspan = '';
Matt Mackall
hgweb: properly check for bookmarks when drawing graph
r15071 if (cur[7].length || cur[8].length || (cur[6][0] != 'default' || cur[6][1])) \{
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 tagspan = '<span class="logtags">';
Matt Mackall
templates: escape javascript braces
r10856 if (cur[6][1]) \{
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 tagspan += '<span class="branchhead" title="' + cur[6][0] + '">';
tagspan += cur[6][0] + '</span> ';
Matt Mackall
templates: escape javascript braces
r10856 } else if (!cur[6][1] && cur[6][0] != 'default') \{
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 tagspan += '<span class="branchname" title="' + cur[6][0] + '">';
tagspan += cur[6][0] + '</span> ';
}
Matt Mackall
templates: escape javascript braces
r10856 if (cur[7].length) \{
for (var t in cur[7]) \{
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 var tag = cur[7][t];
tagspan += '<span class="tag">' + tag + '</span> ';
}
}
Alexander Solovyov
hgweb: add display of bookmarks for changelog and changeset
r13596 if (cur[8].length) \{
for (var b in cur[8]) \{
var bookmark = cur[8][b];
tagspan += '<span class="tag">' + bookmark + '</span> ';
}
}
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 tagspan += '</span>';
}
Mads Kiilerich
hgweb: avoid bad $$ processing in graph (issue3601)...
r17421
var item = '<li style="' + nstyle + '"><span class="desc">';
Thomas Arendsen Hein
hgweb: urlescape all urls, HTML escape repo/tag/branch/... names...
r18526 item += '<a href="{url|urlescape}rev/' + cur[0] + '{sessionvars%urlparameter}" title="' + cur[0] + '">' + cur[3] + '</a>';
Mads Kiilerich
hgweb: avoid bad $$ processing in graph (issue3601)...
r17421 item += '</span>' + tagspan + '<span class="info">' + cur[5] + ', by ' + cur[4] + '</span></li>';
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999
return [bg, item];
}
graph.render(data);
// stop hiding script -->
</script>
<div class="navigate">
av6
hgweb: don't dereference symbolic revision in paper & coal style (issue2296)...
r25606 <a href="{url|urlescape}graph/{symrev}{lessvars%urlparameter}">less</a>
<a href="{url|urlescape}graph/{symrev}{morevars%urlparameter}">more</a>
Nicolas Dumazet
hgweb: changenav: separate pages before and after the current position...
r10254 | rev {rev}: {changenav%navgraph}
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </div>
Alexander Plavin
paper: add infinite scrolling to graph by calling ajaxScrollInit at the page
r19783 <script type="text/javascript">
ajaxScrollInit(
Takumi IINO
hgweb: avoid invalid infinity scroll request when overwritten web.style...
r20253 '{url|urlescape}graph/{rev}?revcount=%next%&style={style}',
Alexander Plavin
paper: add infinite scrolling to graph by calling ajaxScrollInit at the page
r19783 {revcount}+60,
function (htmlText, previousVal) \{ return previousVal + 60; },
'#wrapper',
'<div class="%class%" style="text-align: center;">%text%</div>',
'graph'
);
</script>
Dan Villiom Podlaski Christiansen
setup: install translation files as package data...
r9999 </div>
</div>
{footer}