hgweb: explicitly check if requested command exists

mercurial/hgweb/hgweb_mod.py

@@ -202,17 +202,18 b' class hgweb(object):'
         try:
 
             cmd = req.form.get('cmd', [''])[0]
-            if hasattr(protocol, cmd):
+            if cmd in protocol.__all__:
                 method = getattr(protocol, cmd)
                 method(self, req)
             else:
-
                 tmpl = self.templater(req)
                 if cmd == '':
                     req.form['cmd'] = [tmpl.cache['default']]
                     cmd = req.form['cmd'][0]
 
-                if cmd == 'file' and 'raw' in req.form.get('style', []):
+                if cmd not in webcommands.__all__:
+                    raise ErrorResponse(400, 'No such method: ' + cmd)
+                elif cmd == 'file' and 'raw' in req.form.get('style', []):
                     webcommands.rawfile(self, req, tmpl)
                 else:
                     getattr(webcommands, cmd)(self, req, tmpl)
@@ -227,8 +228,6 b' class hgweb(object):'
                         tmpl('error', error=str(inst)))
         except ErrorResponse, inst:
             req.respond(inst.code, tmpl('error', error=inst.message))
-        except AttributeError:
-            req.respond(400, tmpl('error', error='No such method: ' + cmd))
 
     def templater(self, req):
 

mercurial/hgweb/protocol.py

@@ -10,6 +10,14 b' from mercurial import util, streamclone'
 from mercurial.i18n import gettext as _
 from mercurial.node import *
 
+# __all__ is populated with the allowed commands. Be sure to add to it if
+# you're adding a new command, or the new command won't work.
+
+__all__ = [
+   'lookup', 'heads', 'branches', 'between', 'changegroup',
+   'changegroupsubset', 'capabilities', 'unbundle', 'stream_out',
+]
+
 def lookup(web, req):
     try:
         r = hex(web.repo.lookup(req.form['key'][0]))

mercurial/hgweb/webcommands.py

@@ -9,6 +9,15 b' import os, mimetypes'
 from mercurial import revlog, util, hg
 from common import staticfile, ErrorResponse
 
+# __all__ is populated with the allowed commands. Be sure to add to it if
+# you're adding a new command, or the new command won't work.
+
+__all__ = [
+   'log', 'rawfile', 'file', 'changelog', 'shortlog', 'changeset', 'rev',
+   'manifest', 'tags', 'summary', 'filediff', 'diff', 'annotate', 'filelog',
+   'archive', 'static',
+]
+
 def log(web, req, tmpl):
     if 'file' in req.form and req.form['file'][0]:
         filelog(web, req, tmpl)