# HG changeset patch
# User Dirkjan Ochtman <dirkjan@ochtman.nl>
# Date 2008-01-28 13:58:03
# Node ID 5be210afe1b8c7ae673d74782d97b6c8368e1394
# Parent  0011316fbe0e9121e54c77c6ecbf4f975f679607

hgweb: explicitly check if requested command exists

diff --git a/mercurial/hgweb/hgweb_mod.py b/mercurial/hgweb/hgweb_mod.py
--- a/mercurial/hgweb/hgweb_mod.py
+++ b/mercurial/hgweb/hgweb_mod.py
@@ -202,17 +202,18 @@ class hgweb(object):
         try:
 
             cmd = req.form.get('cmd', [''])[0]
-            if hasattr(protocol, cmd):
+            if cmd in protocol.__all__:
                 method = getattr(protocol, cmd)
                 method(self, req)
             else:
-
                 tmpl = self.templater(req)
                 if cmd == '':
                     req.form['cmd'] = [tmpl.cache['default']]
                     cmd = req.form['cmd'][0]
 
-                if cmd == 'file' and 'raw' in req.form.get('style', []):
+                if cmd not in webcommands.__all__:
+                    raise ErrorResponse(400, 'No such method: ' + cmd)
+                elif cmd == 'file' and 'raw' in req.form.get('style', []):
                     webcommands.rawfile(self, req, tmpl)
                 else:
                     getattr(webcommands, cmd)(self, req, tmpl)
@@ -227,8 +228,6 @@ class hgweb(object):
                         tmpl('error', error=str(inst)))
         except ErrorResponse, inst:
             req.respond(inst.code, tmpl('error', error=inst.message))
-        except AttributeError:
-            req.respond(400, tmpl('error', error='No such method: ' + cmd))
 
     def templater(self, req):
 
diff --git a/mercurial/hgweb/protocol.py b/mercurial/hgweb/protocol.py
--- a/mercurial/hgweb/protocol.py
+++ b/mercurial/hgweb/protocol.py
@@ -10,6 +10,14 @@ from mercurial import util, streamclone
 from mercurial.i18n import gettext as _
 from mercurial.node import *
 
+# __all__ is populated with the allowed commands. Be sure to add to it if
+# you're adding a new command, or the new command won't work.
+
+__all__ = [
+   'lookup', 'heads', 'branches', 'between', 'changegroup',
+   'changegroupsubset', 'capabilities', 'unbundle', 'stream_out',
+]
+
 def lookup(web, req):
     try:
         r = hex(web.repo.lookup(req.form['key'][0]))
diff --git a/mercurial/hgweb/webcommands.py b/mercurial/hgweb/webcommands.py
--- a/mercurial/hgweb/webcommands.py
+++ b/mercurial/hgweb/webcommands.py
@@ -9,6 +9,15 @@ import os, mimetypes
 from mercurial import revlog, util, hg
 from common import staticfile, ErrorResponse
 
+# __all__ is populated with the allowed commands. Be sure to add to it if
+# you're adding a new command, or the new command won't work.
+
+__all__ = [
+   'log', 'rawfile', 'file', 'changelog', 'shortlog', 'changeset', 'rev',
+   'manifest', 'tags', 'summary', 'filediff', 'diff', 'annotate', 'filelog',
+   'archive', 'static',
+]
+
 def log(web, req, tmpl):
     if 'file' in req.form and req.form['file'][0]:
         filelog(web, req, tmpl)