Show More
@@ -801,6 +801,12 b' class hgweb(object):' | |||||
801 | # find tag, changeset, file |
|
801 | # find tag, changeset, file | |
802 |
|
802 | |||
803 | def run(self, req=hgrequest()): |
|
803 | def run(self, req=hgrequest()): | |
|
804 | def clean(path): | |||
|
805 | p = os.path.normpath(path) | |||
|
806 | if p[:2] == "..": | |||
|
807 | raise "suspicious path" | |||
|
808 | return p | |||
|
809 | ||||
804 | def header(**map): |
|
810 | def header(**map): | |
805 | yield self.t("header", **map) |
|
811 | yield self.t("header", **map) | |
806 |
|
812 | |||
@@ -881,7 +887,8 b' class hgweb(object):' | |||||
881 | req.write(self.changeset(req.form['node'][0])) |
|
887 | req.write(self.changeset(req.form['node'][0])) | |
882 |
|
888 | |||
883 | elif req.form['cmd'][0] == 'manifest': |
|
889 | elif req.form['cmd'][0] == 'manifest': | |
884 |
req.write(self.manifest(req.form['manifest'][0], |
|
890 | req.write(self.manifest(req.form['manifest'][0], | |
|
891 | clean(req.form['path'][0]))) | |||
885 |
|
892 | |||
886 | elif req.form['cmd'][0] == 'tags': |
|
893 | elif req.form['cmd'][0] == 'tags': | |
887 | req.write(self.tags()) |
|
894 | req.write(self.tags()) | |
@@ -890,16 +897,20 b' class hgweb(object):' | |||||
890 | req.write(self.summary()) |
|
897 | req.write(self.summary()) | |
891 |
|
898 | |||
892 | elif req.form['cmd'][0] == 'filediff': |
|
899 | elif req.form['cmd'][0] == 'filediff': | |
893 |
req.write(self.filediff(req.form['file'][0], |
|
900 | req.write(self.filediff(clean(req.form['file'][0]), | |
|
901 | req.form['node'][0])) | |||
894 |
|
902 | |||
895 | elif req.form['cmd'][0] == 'file': |
|
903 | elif req.form['cmd'][0] == 'file': | |
896 |
req.write(self.filerevision(req.form['file'][0], |
|
904 | req.write(self.filerevision(clean(req.form['file'][0]), | |
|
905 | req.form['filenode'][0])) | |||
897 |
|
906 | |||
898 | elif req.form['cmd'][0] == 'annotate': |
|
907 | elif req.form['cmd'][0] == 'annotate': | |
899 |
req.write(self.fileannotate(req.form['file'][0], |
|
908 | req.write(self.fileannotate(clean(req.form['file'][0]), | |
|
909 | req.form['filenode'][0])) | |||
900 |
|
910 | |||
901 | elif req.form['cmd'][0] == 'filelog': |
|
911 | elif req.form['cmd'][0] == 'filelog': | |
902 |
req.write(self.filelog(req.form['file'][0], |
|
912 | req.write(self.filelog(clean(req.form['file'][0]), | |
|
913 | req.form['filenode'][0])) | |||
903 |
|
914 | |||
904 | elif req.form['cmd'][0] == 'heads': |
|
915 | elif req.form['cmd'][0] == 'heads': | |
905 | req.httphdr("application/mercurial-0.1") |
|
916 | req.httphdr("application/mercurial-0.1") |
General Comments 0
You need to be logged in to leave comments.
Login now