Mercurial > public > mercurial-scm > hg

comparison mercurial/hgweb/webcommands.py @ 15004:d06b9c55ddab stable

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
hgweb: raw file mimetype guessing configurable, off by default (BC) (issue2923) Before: hgweb made it possible to download file content with a content type detected from the file extension. It would serve .html files as text/html and could thus cause XSS vulnerabilities if the web site had any kind of session authorization and the repository content wasn't fully trusted. Now: all files default to "application/binary", which all important browsers will refuse to treat as text/html. See the table here: https://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors
author Matt Mackall <mpm@selenic.com>
date Sun, 31 Jul 2011 01:46:52 +0200
parents 0cc66f13bea0
children a84698badf0b
comparison
equal deleted inserted replaced
15001:dd74cd1e5d49 15004:d06b9c55ddab
30 return filelog(web, req, tmpl) 30 return filelog(web, req, tmpl)
31 else: 31 else:
32 return changelog(web, req, tmpl) 32 return changelog(web, req, tmpl)
33 33
34 def rawfile(web, req, tmpl): 34 def rawfile(web, req, tmpl):
35 guessmime = web.configbool('web', 'guessmime', False)
36
35 path = webutil.cleanpath(web.repo, req.form.get('file', [''])[0]) 37 path = webutil.cleanpath(web.repo, req.form.get('file', [''])[0])
36 if not path: 38 if not path:
37 content = manifest(web, req, tmpl) 39 content = manifest(web, req, tmpl)
38 req.respond(HTTP_OK, web.ctype) 40 req.respond(HTTP_OK, web.ctype)
39 return content 41 return content
48 except ErrorResponse: 50 except ErrorResponse:
49 raise inst 51 raise inst
50 52
51 path = fctx.path() 53 path = fctx.path()
52 text = fctx.data() 54 text = fctx.data()
53 mt = mimetypes.guess_type(path)[0] 55 mt = 'application/binary'
54 if mt is None: 56 if guessmime:
55 mt = binary(text) and 'application/octet-stream' or 'text/plain' 57 mt = mimetypes.guess_type(path)[0]
58 if mt is None:
59 mt = binary(text) and 'application/binary' or 'text/plain'
56 if mt.startswith('text/'): 60 if mt.startswith('text/'):
57 mt += '; charset="%s"' % encoding.encoding 61 mt += '; charset="%s"' % encoding.encoding
58 62
59 req.respond(HTTP_OK, mt, path, len(text)) 63 req.respond(HTTP_OK, mt, path, len(text))
60 return [text] 64 return [text]