Mercurial > public > mercurial-scm > hg
comparison mercurial/hgweb/hgweb_mod.py @ 8860:36654238c050
hgweb: deny cloning a subpath of a repo
author | Benoit Boissinot <benoit.boissinot@ens-lyon.org> |
---|---|
date | Sat, 20 Jun 2009 16:42:51 -0500 |
parents | 580a79dde2a3 |
children | 0e080d519d1b |
comparison
equal
deleted
inserted
replaced
8859:580a79dde2a3 | 8860:36654238c050 |
---|---|
80 | 80 |
81 def run_wsgi(self, req): | 81 def run_wsgi(self, req): |
82 | 82 |
83 self.refresh() | 83 self.refresh() |
84 | 84 |
85 # work with CGI variables to create coherent structure | |
86 # use SCRIPT_NAME, PATH_INFO and QUERY_STRING as well as our REPO_NAME | |
87 | |
88 req.url = req.env['SCRIPT_NAME'] | |
89 if not req.url.endswith('/'): | |
90 req.url += '/' | |
91 if 'REPO_NAME' in req.env: | |
92 req.url += req.env['REPO_NAME'] + '/' | |
93 | |
94 if 'PATH_INFO' in req.env: | |
95 parts = req.env['PATH_INFO'].strip('/').split('/') | |
96 repo_parts = req.env.get('REPO_NAME', '').split('/') | |
97 if parts[:len(repo_parts)] == repo_parts: | |
98 parts = parts[len(repo_parts):] | |
99 query = '/'.join(parts) | |
100 else: | |
101 query = req.env['QUERY_STRING'].split('&', 1)[0] | |
102 query = query.split(';', 1)[0] | |
103 | |
85 # process this if it's a protocol request | 104 # process this if it's a protocol request |
86 # protocol bits don't need to create any URLs | 105 # protocol bits don't need to create any URLs |
87 # and the clients always use the old URL structure | 106 # and the clients always use the old URL structure |
88 | 107 |
89 cmd = req.form.get('cmd', [''])[0] | 108 cmd = req.form.get('cmd', [''])[0] |
90 if cmd and cmd in protocol.__all__: | 109 if cmd and cmd in protocol.__all__: |
110 if query: | |
111 raise ErrorResponse(HTTP_NOT_FOUND) | |
91 try: | 112 try: |
92 if cmd in perms: | 113 if cmd in perms: |
93 try: | 114 try: |
94 self.check_perm(req, perms[cmd]) | 115 self.check_perm(req, perms[cmd]) |
95 except ErrorResponse, inst: | 116 except ErrorResponse, inst: |
102 req.respond(inst, protocol.HGTYPE) | 123 req.respond(inst, protocol.HGTYPE) |
103 if not inst.message: | 124 if not inst.message: |
104 return [] | 125 return [] |
105 return '0\n%s\n' % inst.message, | 126 return '0\n%s\n' % inst.message, |
106 | 127 |
107 # work with CGI variables to create coherent structure | |
108 # use SCRIPT_NAME, PATH_INFO and QUERY_STRING as well as our REPO_NAME | |
109 | |
110 req.url = req.env['SCRIPT_NAME'] | |
111 if not req.url.endswith('/'): | |
112 req.url += '/' | |
113 if 'REPO_NAME' in req.env: | |
114 req.url += req.env['REPO_NAME'] + '/' | |
115 | |
116 if 'PATH_INFO' in req.env: | |
117 parts = req.env['PATH_INFO'].strip('/').split('/') | |
118 repo_parts = req.env.get('REPO_NAME', '').split('/') | |
119 if parts[:len(repo_parts)] == repo_parts: | |
120 parts = parts[len(repo_parts):] | |
121 query = '/'.join(parts) | |
122 else: | |
123 query = req.env['QUERY_STRING'].split('&', 1)[0] | |
124 query = query.split(';', 1)[0] | |
125 | |
126 # translate user-visible url structure to internal structure | 128 # translate user-visible url structure to internal structure |
127 | 129 |
128 args = query.split('/', 2) | 130 args = query.split('/', 2) |
129 if 'cmd' not in req.form and args and args[0]: | 131 if 'cmd' not in req.form and args and args[0]: |
130 | 132 |