##// END OF EJS Templates
upstream » mercurial-mirror
RSS

Clone from https://www.mercurial-scm.org/repo/hg-all

hgweb: always perform permissions checks on protocol commands (BC) (SEC)...
Gregory Szorc -
r36774:2ecb0fc5 stable
parent child Browse files
Show More
Show file before | Show file after | Hide comments
@@ -362,8 +362,11 b' class hgweb(object):'
362 raise ErrorResponse(HTTP_NOT_FOUND)
362 raise ErrorResponse(HTTP_NOT_FOUND)
363
363
364 req.checkperm = lambda op: self.check_perm(rctx, req, op)
364 req.checkperm = lambda op: self.check_perm(rctx, req, op)
365 if cmd in perms:
365 # Assume commands with no defined permissions are writes /
366 req.checkperm(perms[cmd])
366 # for pushes. This is the safest from a security perspective
367 # because it doesn't allow commands with undefined semantics
368 # from bypassing permissions checks.
369 req.checkperm(perms.get(cmd, 'push'))
367 return protocol.call(rctx.repo, req, cmd)
370 return protocol.call(rctx.repo, req, cmd)
368 except ErrorResponse as inst:
371 except ErrorResponse as inst:
369 # A client that sends unbundle without 100-continue will
372 # A client that sends unbundle without 100-continue will
Show file before | Show file after | Hide comments
@@ -90,12 +90,12 b' web.deny_read=* prevents access to wire '
90 read not authorized
90 read not authorized
91 [1]
91 [1]
92
92
93 TODO custom commands don't check permissions
94
95 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
93 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
96 200 Script output follows
94 401 read not authorized
97
95
98 read-only command no defined permissions
96 0
97 read not authorized
98 [1]
99
99
100 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
100 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
101 401 read not authorized
101 401 read not authorized
@@ -105,9 +105,11 b" TODO custom commands don't check permiss"
105 [1]
105 [1]
106
106
107 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
107 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
108 200 Script output follows
108 401 read not authorized
109
109
110 write command no defined permissions
110 0
111 read not authorized
112 [1]
111
113
112 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
114 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
113 401 read not authorized
115 401 read not authorized
@@ -149,12 +151,12 b' web.deny_read=* with REMOTE_USER set sti'
149 read not authorized
151 read not authorized
150 [1]
152 [1]
151
153
152 TODO custom commands don't check permissions
153
154 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
154 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
155 200 Script output follows
155 401 read not authorized
156
156
157 read-only command no defined permissions
157 0
158 read not authorized
159 [1]
158
160
159 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
161 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
160 401 read not authorized
162 401 read not authorized
@@ -164,9 +166,11 b" TODO custom commands don't check permiss"
164 [1]
166 [1]
165
167
166 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
168 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
167 200 Script output follows
169 401 read not authorized
168
170
169 write command no defined permissions
171 0
172 read not authorized
173 [1]
170
174
171 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
175 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
172 401 read not authorized
176 401 read not authorized
@@ -206,12 +210,12 b' web.deny_read=<user> denies access to un'
206 read not authorized
210 read not authorized
207 [1]
211 [1]
208
212
209 TODO custom commands don't check permissions
210
211 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
213 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
212 200 Script output follows
214 401 read not authorized
213
215
214 read-only command no defined permissions
216 0
217 read not authorized
218 [1]
215
219
216 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
220 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
217 401 read not authorized
221 401 read not authorized
@@ -221,9 +225,11 b" TODO custom commands don't check permiss"
221 [1]
225 [1]
222
226
223 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
227 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
224 200 Script output follows
228 401 read not authorized
225
229
226 write command no defined permissions
230 0
231 read not authorized
232 [1]
227
233
228 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
234 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
229 401 read not authorized
235 401 read not authorized
@@ -258,12 +264,12 b' web.deny_read=<user> denies access to us'
258 read not authorized
264 read not authorized
259 [1]
265 [1]
260
266
261 TODO custom commands don't check permissions
262
263 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
267 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
264 200 Script output follows
268 401 read not authorized
265
269
266 read-only command no defined permissions
270 0
271 read not authorized
272 [1]
267
273
268 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
274 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
269 401 read not authorized
275 401 read not authorized
@@ -273,9 +279,11 b" TODO custom commands don't check permiss"
273 [1]
279 [1]
274
280
275 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
281 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
276 200 Script output follows
282 401 read not authorized
277
283
278 write command no defined permissions
284 0
285 read not authorized
286 [1]
279
287
280 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
288 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
281 401 read not authorized
289 401 read not authorized
@@ -309,21 +317,23 b' web.deny_read=<user> allows access to au'
309 publishing True (no-eol)
317 publishing True (no-eol)
310
318
311 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
319 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
312 200 Script output follows
320 405 push requires POST request
313
321
314 read-only command no defined permissions
322 0
323 push requires POST request
324 [1]
315
325
316 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
326 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
317 200 Script output follows
327 200 Script output follows
318
328
319 read-only command w/ defined permissions
329 read-only command w/ defined permissions
320
330
321 TODO custom commands don't check permissions
322
323 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
331 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
324 200 Script output follows
332 405 push requires POST request
325
333
326 write command no defined permissions
334 0
335 push requires POST request
336 [1]
327
337
328 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
338 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
329 405 push requires POST request
339 405 push requires POST request
@@ -362,21 +372,23 b' web.allow_read=* allows reads for unauth'
362 publishing True (no-eol)
372 publishing True (no-eol)
363
373
364 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
374 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
365 200 Script output follows
375 405 push requires POST request
366
376
367 read-only command no defined permissions
377 0
378 push requires POST request
379 [1]
368
380
369 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
381 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
370 200 Script output follows
382 200 Script output follows
371
383
372 read-only command w/ defined permissions
384 read-only command w/ defined permissions
373
385
374 TODO custom commands don't check permissions
375
376 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
386 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
377 200 Script output follows
387 405 push requires POST request
378
388
379 write command no defined permissions
389 0
390 push requires POST request
391 [1]
380
392
381 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
393 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
382 405 push requires POST request
394 405 push requires POST request
@@ -410,21 +422,23 b' web.allow_read=* allows read for authent'
410 publishing True (no-eol)
422 publishing True (no-eol)
411
423
412 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
424 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
413 200 Script output follows
425 405 push requires POST request
414
426
415 read-only command no defined permissions
427 0
428 push requires POST request
429 [1]
416
430
417 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
431 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
418 200 Script output follows
432 200 Script output follows
419
433
420 read-only command w/ defined permissions
434 read-only command w/ defined permissions
421
435
422 TODO custom commands don't check permissions
423
424 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
436 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
425 200 Script output follows
437 405 push requires POST request
426
438
427 write command no defined permissions
439 0
440 push requires POST request
441 [1]
428
442
429 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
443 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
430 405 push requires POST request
444 405 push requires POST request
@@ -464,12 +478,12 b' web.allow_read=<user> does not allow una'
464 read not authorized
478 read not authorized
465 [1]
479 [1]
466
480
467 TODO custom commands don't check permissions
468
469 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
481 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
470 200 Script output follows
482 401 read not authorized
471
483
472 read-only command no defined permissions
484 0
485 read not authorized
486 [1]
473
487
474 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
488 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
475 401 read not authorized
489 401 read not authorized
@@ -479,9 +493,11 b" TODO custom commands don't check permiss"
479 [1]
493 [1]
480
494
481 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
495 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
482 200 Script output follows
496 401 read not authorized
483
497
484 write command no defined permissions
498 0
499 read not authorized
500 [1]
485
501
486 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
502 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
487 401 read not authorized
503 401 read not authorized
@@ -516,12 +532,12 b' web.allow_read=<user> does not allow use'
516 read not authorized
532 read not authorized
517 [1]
533 [1]
518
534
519 TODO custom commands don't check permissions
520
521 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
535 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
522 200 Script output follows
536 401 read not authorized
523
537
524 read-only command no defined permissions
538 0
539 read not authorized
540 [1]
525
541
526 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
542 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
527 401 read not authorized
543 401 read not authorized
@@ -531,9 +547,11 b" TODO custom commands don't check permiss"
531 [1]
547 [1]
532
548
533 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
549 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
534 200 Script output follows
550 401 read not authorized
535
551
536 write command no defined permissions
552 0
553 read not authorized
554 [1]
537
555
538 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
556 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
539 401 read not authorized
557 401 read not authorized
@@ -567,21 +585,23 b' web.allow_read=<user> allows read from u'
567 publishing True (no-eol)
585 publishing True (no-eol)
568
586
569 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
587 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
570 200 Script output follows
588 405 push requires POST request
571
589
572 read-only command no defined permissions
590 0
591 push requires POST request
592 [1]
573
593
574 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
594 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
575 200 Script output follows
595 200 Script output follows
576
596
577 read-only command w/ defined permissions
597 read-only command w/ defined permissions
578
598
579 TODO custom commands don't check permissions
580
581 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
599 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
582 200 Script output follows
600 405 push requires POST request
583
601
584 write command no defined permissions
602 0
603 push requires POST request
604 [1]
585
605
586 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
606 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
587 405 push requires POST request
607 405 push requires POST request
@@ -622,12 +642,12 b' web.deny_read takes precedence over web.'
622 read not authorized
642 read not authorized
623 [1]
643 [1]
624
644
625 TODO custom commands don't check permissions
626
627 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
645 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
628 200 Script output follows
646 401 read not authorized
629
647
630 read-only command no defined permissions
648 0
649 read not authorized
650 [1]
631
651
632 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
652 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
633 401 read not authorized
653 401 read not authorized
@@ -637,9 +657,11 b" TODO custom commands don't check permiss"
637 [1]
657 [1]
638
658
639 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
659 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
640 200 Script output follows
660 401 read not authorized
641
661
642 write command no defined permissions
662 0
663 read not authorized
664 [1]
643
665
644 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
666 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
645 401 read not authorized
667 401 read not authorized
@@ -686,12 +708,12 b' web.allow-pull=false denies read access '
686 pull not authorized
708 pull not authorized
687 [1]
709 [1]
688
710
689 TODO custom commands don't check permissions
690
691 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
711 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
692 200 Script output follows
712 405 push requires POST request
693
713
694 read-only command no defined permissions
714 0
715 push requires POST request
716 [1]
695
717
696 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
718 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
697 401 pull not authorized
719 401 pull not authorized
@@ -701,9 +723,11 b" TODO custom commands don't check permiss"
701 [1]
723 [1]
702
724
703 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
725 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
704 200 Script output follows
726 405 push requires POST request
705
727
706 write command no defined permissions
728 0
729 push requires POST request
730 [1]
707
731
708 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
732 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
709 405 push requires POST request
733 405 push requires POST request
@@ -747,12 +771,12 b' Attempting a write command with HTTP GET'
747 abort: bookmark 'bm' does not exist
771 abort: bookmark 'bm' does not exist
748 [255]
772 [255]
749
773
750 TODO custom commands don't check permissions
751
752 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
774 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
753 200 Script output follows
775 405 push requires POST request
754
776
755 write command no defined permissions
777 0
778 push requires POST request
779 [1]
756
780
757 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
781 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
758 405 push requires POST request
782 405 push requires POST request
@@ -788,12 +812,12 b' Attempting a write command with an unkno'
788 abort: bookmark 'bm' does not exist
812 abort: bookmark 'bm' does not exist
789 [255]
813 [255]
790
814
791 TODO custom commands don't check permissions
792
793 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
815 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
794 200 Script output follows
816 405 push requires POST request
795
817
796 write command no defined permissions
818 0
819 push requires POST request
820 [1]
797
821
798 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
822 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
799 405 push requires POST request
823 405 push requires POST request
@@ -829,12 +853,12 b' Pushing on a plaintext channel is disabl'
829 $ hg bookmarks
853 $ hg bookmarks
830 no bookmarks set
854 no bookmarks set
831
855
832 TODO custom commands don't check permissions
833
834 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
856 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
835 200 Script output follows
857 403 ssl required
836
858
837 write command no defined permissions
859 0
860 ssl required
861 [1]
838
862
839 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
863 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
840 403 ssl required
864 403 ssl required
@@ -892,12 +916,12 b' web.deny_push=* denies pushing to unauth'
892 $ hg bookmarks
916 $ hg bookmarks
893 no bookmarks set
917 no bookmarks set
894
918
895 TODO custom commands don't check permissions
896
897 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
919 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
898 200 Script output follows
920 401 push not authorized
899
921
900 write command no defined permissions
922 0
923 push not authorized
924 [1]
901
925
902 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
926 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
903 401 push not authorized
927 401 push not authorized
@@ -949,12 +973,12 b' web.deny_push=* denies pushing to authen'
949 $ hg bookmarks
973 $ hg bookmarks
950 no bookmarks set
974 no bookmarks set
951
975
952 TODO custom commands don't check permissions
953
954 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
976 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
955 200 Script output follows
977 401 push not authorized
956
978
957 write command no defined permissions
979 0
980 push not authorized
981 [1]
958
982
959 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
983 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
960 401 push not authorized
984 401 push not authorized
@@ -1012,12 +1036,12 b' web.deny_push=<user> denies pushing to u'
1012 $ hg bookmarks
1036 $ hg bookmarks
1013 no bookmarks set
1037 no bookmarks set
1014
1038
1015 TODO custom commands don't check permissions
1016
1017 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1039 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1018 200 Script output follows
1040 401 push not authorized
1019
1041
1020 write command no defined permissions
1042 0
1043 push not authorized
1044 [1]
1021
1045
1022 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1046 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1023 401 push not authorized
1047 401 push not authorized
@@ -1069,12 +1093,12 b' web.deny_push=<user> denies pushing to u'
1069 $ hg bookmarks
1093 $ hg bookmarks
1070 no bookmarks set
1094 no bookmarks set
1071
1095
1072 TODO custom commands don't check permissions
1073
1074 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1096 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1075 200 Script output follows
1097 401 push not authorized
1076
1098
1077 write command no defined permissions
1099 0
1100 push not authorized
1101 [1]
1078
1102
1079 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1103 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1080 401 push not authorized
1104 401 push not authorized
@@ -1242,12 +1266,12 b' web.allow-push=<user> denies push to use'
1242 $ hg bookmarks
1266 $ hg bookmarks
1243 no bookmarks set
1267 no bookmarks set
1244
1268
1245 TODO custom commands don't check permissions
1246
1247 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1269 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1248 200 Script output follows
1270 401 push not authorized
1249
1271
1250 write command no defined permissions
1272 0
1273 push not authorized
1274 [1]
1251
1275
1252 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1276 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1253 401 push not authorized
1277 401 push not authorized
@@ -1367,12 +1391,12 b' web.deny_push takes precedence over web.'
1367 $ hg bookmarks
1391 $ hg bookmarks
1368 no bookmarks set
1392 no bookmarks set
1369
1393
1370 TODO custom commands don't check permissions
1371
1372 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1394 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1373 200 Script output follows
1395 401 push not authorized
1374
1396
1375 write command no defined permissions
1397 0
1398 push not authorized
1399 [1]
1376
1400
1377 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1401 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1378 401 push not authorized
1402 401 push not authorized
@@ -1431,12 +1455,12 b' web.allow-push has no effect if web.deny'
1431 $ hg bookmarks
1455 $ hg bookmarks
1432 no bookmarks set
1456 no bookmarks set
1433
1457
1434 TODO custom commands don't check permissions
1435
1436 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
1458 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadnoperm'
1437 200 Script output follows
1459 401 read not authorized
1438
1460
1439 read-only command no defined permissions
1461 0
1462 read not authorized
1463 [1]
1440
1464
1441 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
1465 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customreadwithperm'
1442 401 read not authorized
1466 401 read not authorized
@@ -1446,9 +1470,11 b" TODO custom commands don't check permiss"
1446 [1]
1470 [1]
1447
1471
1448 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1472 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritenoperm'
1449 200 Script output follows
1473 401 read not authorized
1450
1474
1451 write command no defined permissions
1475 0
1476 read not authorized
1477 [1]
1452
1478
1453 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1479 $ get-with-headers.py $LOCALIP:$HGPORT '?cmd=customwritewithperm'
1454 401 read not authorized
1480 401 read not authorized
General Comments 0
You need to be logged in to leave comments. Login now