# HG changeset patch # User Gregory Szorc # Date 2015-08-22 23:28:22 # Node ID 84511b1d9724a73cb7362ad8dff5a340d799b81d # Parent 268b39770c282b6f6ea1028f9fa4831877e36122 hgweb: move templatepath to requestcontext This does change behavior in that the templatepath could change during the lifetime of the server. But everything else can change, I don't see why template paths can't. diff --git a/mercurial/hgweb/hgweb_mod.py b/mercurial/hgweb/hgweb_mod.py --- a/mercurial/hgweb/hgweb_mod.py +++ b/mercurial/hgweb/hgweb_mod.py @@ -84,6 +84,12 @@ class requestcontext(object): object.__setattr__(self, 'allowpull', self.configbool('web', 'allowpull', True)) + # we use untrusted=False to prevent a repo owner from using + # web.templates in .hg/hgrc to get access to any file readable + # by the user running the CGI script + object.__setattr__(self, 'templatepath', + self.config('web', 'templates', untrusted=False)) + # Proxy unknown reads and writes to the application instance # until everything is moved to us. def __getattr__(self, name): @@ -158,10 +164,6 @@ class hgweb(object): self.repostate = None self.mtime = -1 self.reponame = name - # we use untrusted=False to prevent a repo owner from using - # web.templates in .hg/hgrc to get access to any file readable - # by the user running the CGI script - self.templatepath = self.config('web', 'templates', untrusted=False) self.websubtable = webutil.getwebsubs(r) # The CGI scripts are often run by a user different from the repo owner.