##// END OF EJS Templates
hgweb: fail if an invalid command was supplied in url path (issue4071)...
hgweb: fail if an invalid command was supplied in url path (issue4071) Traditionally, the way to specify a command for hgweb was to use url query arguments (e.g. "?cmd=batch"). If the command is unknown to hgweb, it gives an error (e.g. "400 no such method: badcmd"). But there's also another way to specify a command: as a url path fragment (e.g. "/graph"). Before, hgweb was made forgiving (looks like it was made in 44c5157474e7) and user could put any unknown command in the url. If hgweb couldn't understand it, it would just silently fall back to the default command, which depends on the actual style (e.g. for paper it's shortlog, for monoblue it's summary). This was inconsistent and was breaking some tools that rely on http status codes (as noted in the issue4071). So this patch changes that behavior to the more consistent one, i.e. hgweb will now return "400 no such method: badcmd". So if some tool was relying on having an invalid command return http status code 200 and also have some information, then it will stop working. That is, if somebody typed foobar when they really meant shortlog (and the user was lucky enough to choose a style where the default command is shortlog too), that fact will now be revealed. Code-wise, the changed if block is only relevant when there's no "?cmd" query parameter (i.e. only when command is specified as a url path fragment), and looks like the removed else branch was there only for falling back to default command. With that removed, the rest of the code works as expected: it looks at the command, and if it's not known, raises a proper ErrorResponse exception with an appropriate message. Evidently, there were no tests that required the old behavior. But, frankly, I don't know any way to tell if anyone actually exploited such forgiving behavior in some in-house tool.

File last commit:

r20962:af4158b8 default
r22506:6e1fbcb1 stable
Show More
statichttprepo.py
164 lines | 5.2 KiB | text/x-python | PythonLexer
# statichttprepo.py - simple http repository class for mercurial
#
# This provides read-only repo access to repositories exported via static http
#
# Copyright 2005-2007 Matt Mackall <mpm@selenic.com>
#
# This software may be used and distributed according to the terms of the
# GNU General Public License version 2 or any later version.
from i18n import _
import changelog, byterange, url, error
import localrepo, manifest, util, scmutil, store
import urllib, urllib2, errno, os
class httprangereader(object):
def __init__(self, url, opener):
# we assume opener has HTTPRangeHandler
self.url = url
self.pos = 0
self.opener = opener
self.name = url
def seek(self, pos):
self.pos = pos
def read(self, bytes=None):
req = urllib2.Request(self.url)
end = ''
if bytes:
end = self.pos + bytes - 1
if self.pos or end:
req.add_header('Range', 'bytes=%d-%s' % (self.pos, end))
try:
f = self.opener.open(req)
data = f.read()
# Python 2.6+ defines a getcode() function, and 2.4 and
# 2.5 appear to always have an undocumented code attribute
# set. If we can't read either of those, fall back to 206
# and hope for the best.
code = getattr(f, 'getcode', lambda : getattr(f, 'code', 206))()
except urllib2.HTTPError, inst:
num = inst.code == 404 and errno.ENOENT or None
raise IOError(num, inst)
except urllib2.URLError, inst:
raise IOError(None, inst.reason[1])
if code == 200:
# HTTPRangeHandler does nothing if remote does not support
# Range headers and returns the full entity. Let's slice it.
if bytes:
data = data[self.pos:self.pos + bytes]
else:
data = data[self.pos:]
elif bytes:
data = data[:bytes]
self.pos += len(data)
return data
def readlines(self):
return self.read().splitlines(True)
def __iter__(self):
return iter(self.readlines())
def close(self):
pass
def build_opener(ui, authinfo):
# urllib cannot handle URLs with embedded user or passwd
urlopener = url.opener(ui, authinfo)
urlopener.add_handler(byterange.HTTPRangeHandler())
class statichttpvfs(scmutil.abstractvfs):
def __init__(self, base):
self.base = base
def __call__(self, path, mode="r", atomictemp=None):
if mode not in ('r', 'rb'):
raise IOError('Permission denied')
f = "/".join((self.base, urllib.quote(path)))
return httprangereader(f, urlopener)
def join(self, path):
if path:
return os.path.join(self.base, path)
else:
return self.base
return statichttpvfs
class statichttppeer(localrepo.localpeer):
def local(self):
return None
def canpush(self):
return False
class statichttprepository(localrepo.localrepository):
supported = localrepo.localrepository._basesupported
def __init__(self, ui, path):
self._url = path
self.ui = ui
self.root = path
u = util.url(path.rstrip('/') + "/.hg")
self.path, authinfo = u.authinfo()
opener = build_opener(ui, authinfo)
self.opener = opener(self.path)
self.vfs = self.opener
self._phasedefaults = []
try:
requirements = scmutil.readrequires(self.opener, self.supported)
except IOError, inst:
if inst.errno != errno.ENOENT:
raise
requirements = set()
# check if it is a non-empty old-style repository
try:
fp = self.opener("00changelog.i")
fp.read(1)
fp.close()
except IOError, inst:
if inst.errno != errno.ENOENT:
raise
# we do not care about empty old-style repositories here
msg = _("'%s' does not appear to be an hg repository") % path
raise error.RepoError(msg)
# setup store
self.store = store.store(requirements, self.path, opener)
self.spath = self.store.path
self.sopener = self.store.opener
self.svfs = self.sopener
self.sjoin = self.store.join
self._filecache = {}
self.requirements = requirements
self.manifest = manifest.manifest(self.sopener)
self.changelog = changelog.changelog(self.sopener)
self._tags = None
self.nodetagscache = None
self._branchcaches = {}
self.encodepats = None
self.decodepats = None
def _restrictcapabilities(self, caps):
caps = super(statichttprepository, self)._restrictcapabilities(caps)
return caps.difference(["pushkey"])
def url(self):
return self._url
def local(self):
return False
def peer(self):
return statichttppeer(self)
def lock(self, wait=True):
raise util.Abort(_('cannot lock static-http repository'))
def instance(ui, path, create):
if create:
raise util.Abort(_('cannot create new static-http repository'))
return statichttprepository(ui, path[7:])