Mercurial > public > mercurial-scm > hg

comparison mercurial/hgweb/hgweb_mod.py @ 36799:c638a13093cf

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
wireprotoserver: check permissions in main dispatch function The permissions checking code merged from stable is out of place in the refactored hgweb_mod module. This commit moves the main call to wireprotoserver. We still have some lingering code in hgweb_mod. This will get addressed later. Differential Revision: https://phab.mercurial-scm.org/D2717
author Gregory Szorc <gregory.szorc@gmail.com>
date Tue, 06 Mar 2018 15:08:33 -0800
parents 7bf80d9d9543
children 0b18604db95e
comparison
equal deleted inserted replaced
36798:7574c8173d5e 36799:c638a13093cf
355 # Route it to a wire protocol handler if it looks like a wire protocol 355 # Route it to a wire protocol handler if it looks like a wire protocol
356 # request. 356 # request.
357 protohandler = wireprotoserver.parsehttprequest(rctx.repo, req, query) 357 protohandler = wireprotoserver.parsehttprequest(rctx.repo, req, query)
358 358
359 if protohandler: 359 if protohandler:
360 cmd = protohandler['cmd']
361 try: 360 try:
362 if query: 361 if query:
363 raise ErrorResponse(HTTP_NOT_FOUND) 362 raise ErrorResponse(HTTP_NOT_FOUND)
364 363
365 # TODO fold this into parsehttprequest 364 # TODO fold this into parsehttprequest
366 req.checkperm = lambda op: self.check_perm(rctx, req, op) 365 checkperm = lambda op: self.check_perm(rctx, req, op)
367 protohandler['proto'].checkperm = req.checkperm 366 protohandler['proto'].checkperm = checkperm
368 367
369 # Assume commands with no defined permissions are writes / 368 return protohandler['dispatch'](checkperm)
370 # for pushes. This is the safest from a security perspective
371 # because it doesn't allow commands with undefined semantics
372 # from bypassing permissions checks.
373 req.checkperm(perms.get(cmd, 'push'))
374
375 return protohandler['dispatch']()
376 except ErrorResponse as inst: 369 except ErrorResponse as inst:
377 return protohandler['handleerror'](inst) 370 return protohandler['handleerror'](inst)
378 371
379 # translate user-visible url structure to internal structure 372 # translate user-visible url structure to internal structure
380 373