Diffstat (limited to 'ui-clone.c')
| -rw-r--r-- | ui-clone.c | 83 |
1 files changed, 56 insertions, 27 deletions
@@ -7,45 +7,52 @@ * (see COPYING for full license text) */ +#define USE_THE_REPOSITORY_VARIABLE + #include "cgit.h" #include "ui-clone.h" #include "html.h" #include "ui-shared.h" +#include "packfile.h" -static int print_ref_info(const char *refname, const struct object_id *oid, - int flags, void *cb_data) +static int print_ref_info(const struct reference *ref, void *cb_data) { struct object *obj; - if (!(obj = parse_object(oid->hash))) + if (!(obj = parse_object(the_repository, ref->oid))) return 0; - htmlf("%s\t%s\n", oid_to_hex(oid), refname); + htmlf("%s\t%s\n", oid_to_hex(ref->oid), ref->name); if (obj->type == OBJ_TAG) { - if (!(obj = deref_tag(obj, refname, 0))) + if (!(obj = deref_tag(the_repository, obj, ref->name, 0))) return 0; - htmlf("%s\t%s^{}\n", sha1_to_hex(obj->sha1), refname); + htmlf("%s\t%s^{}\n", oid_to_hex(&obj->oid), ref->name); } return 0; } static void print_pack_info(void) { - struct packed_git *pack; + struct odb_source *source; char *offset; ctx.page.mimetype = "text/plain"; ctx.page.filename = "objects/info/packs"; cgit_print_http_headers(); - prepare_packed_git(); - for (pack = packed_git; pack; pack = pack->next) { - if (pack->pack_local) { - offset = strrchr(pack->pack_name, '/'); - if (offset && offset[1] != '\0') - ++offset; - else - offset = pack->pack_name; - htmlf("P %s\n", offset); + odb_reprepare(the_repository->objects); + for (source = the_repository->objects->sources; source; source = source->next) { + struct odb_source_files *files = odb_source_files_downcast(source); + struct packfile_list_entry *e; + for (e = files->packed->packs.head; e; e = e->next) { + struct packed_git *p = e->pack; + if (p->pack_local) { + offset = strrchr(p->pack_name, '/'); + if (offset && offset[1] != '\0') + ++offset; + else + offset = p->pack_name; + htmlf("P %s\n", offset); + } } } } @@ -57,13 +64,13 @@ static void send_file(const char *path) if (stat(path, &st)) { switch (errno) { case ENOENT: - html_status(404, "Not found", 0); + cgit_print_error_page(404, "Not found", "Not found"); break; case EACCES: - html_status(403, "Forbidden", 0); + cgit_print_error_page(403, "Forbidden", "Forbidden"); break; default: - html_status(400, "Bad request", 0); + cgit_print_error_page(400, "Bad request", "Bad request"); } return; } @@ -78,32 +85,54 @@ static void send_file(const char *path) void cgit_clone_info(void) { if (!ctx.qry.path || strcmp(ctx.qry.path, "refs")) { - html_status(400, "Bad request", 0); + cgit_print_error_page(400, "Bad request", "Bad request"); return; } ctx.page.mimetype = "text/plain"; ctx.page.filename = "info/refs"; cgit_print_http_headers(); - for_each_ref(print_ref_info, NULL); + refs_for_each_ref(get_main_ref_store(the_repository), + print_ref_info, NULL); } void cgit_clone_objects(void) { - if (!ctx.qry.path) { - html_status(400, "Bad request", 0); - return; - } + char *p, *path; + + if (!ctx.qry.path) + goto err; if (!strcmp(ctx.qry.path, "info/packs")) { print_pack_info(); return; } - send_file(git_path("objects/%s", ctx.qry.path)); + /* Avoid directory traversal by forbidding "..", but also work around + * other funny business by just specifying a fairly strict format. For + * example, now we don't have to stress out about the Cygwin port. + */ + for (p = ctx.qry.path; *p; ++p) { + if (*p == '.' && *(p + 1) == '.') + goto err; + if (!isalnum(*p) && *p != '/' && *p != '.' && *p != '-') + goto err; + } + + path = repo_git_path(the_repository, "objects/%s", ctx.qry.path); + send_file(path); + free(path); + return; + +err: + cgit_print_error_page(400, "Bad request", "Bad request"); } void cgit_clone_head(void) { - send_file(git_path("%s", "HEAD")); + char *path; + + path = repo_git_path(the_repository, "HEAD"); + send_file(path); + free(path); } |