Diffstat (limited to 'ui-clone.c')
| -rw-r--r-- | ui-clone.c | 91 |
1 files changed, 64 insertions, 27 deletions
@@ -7,95 +7,132 @@ * (see COPYING for full license text) */ +#define USE_THE_REPOSITORY_VARIABLE + #include "cgit.h" #include "ui-clone.h" #include "html.h" #include "ui-shared.h" +#include "packfile.h" -static int print_ref_info(const char *refname, const unsigned char *sha1, - int flags, void *cb_data) +static int print_ref_info(const struct reference *ref, void *cb_data) { struct object *obj; - if (!(obj = parse_object(sha1))) + if (!(obj = parse_object(the_repository, ref->oid))) return 0; - htmlf("%s\t%s\n", sha1_to_hex(sha1), refname); + htmlf("%s\t%s\n", oid_to_hex(ref->oid), ref->name); if (obj->type == OBJ_TAG) { - if (!(obj = deref_tag(obj, refname, 0))) + if (!(obj = deref_tag(the_repository, obj, ref->name, 0))) return 0; - htmlf("%s\t%s^{}\n", sha1_to_hex(obj->sha1), refname); + htmlf("%s\t%s^{}\n", oid_to_hex(&obj->oid), ref->name); } return 0; } static void print_pack_info(void) { - struct packed_git *pack; - int ofs; + struct odb_source *source; + char *offset; ctx.page.mimetype = "text/plain"; ctx.page.filename = "objects/info/packs"; cgit_print_http_headers(); - ofs = strlen(ctx.repo->path) + strlen("/objects/pack/"); - prepare_packed_git(); - for (pack = packed_git; pack; pack = pack->next) - if (pack->pack_local) - htmlf("P %s\n", pack->pack_name + ofs); + odb_reprepare(the_repository->objects); + for (source = the_repository->objects->sources; source; source = source->next) { + struct odb_source_files *files = odb_source_files_downcast(source); + struct packfile_list_entry *e; + for (e = files->packed->packs.head; e; e = e->next) { + struct packed_git *p = e->pack; + if (p->pack_local) { + offset = strrchr(p->pack_name, '/'); + if (offset && offset[1] != '\0') + ++offset; + else + offset = p->pack_name; + htmlf("P %s\n", offset); + } + } + } } -static void send_file(char *path) +static void send_file(const char *path) { struct stat st; if (stat(path, &st)) { switch (errno) { case ENOENT: - html_status(404, "Not found", 0); + cgit_print_error_page(404, "Not found", "Not found"); break; case EACCES: - html_status(403, "Forbidden", 0); + cgit_print_error_page(403, "Forbidden", "Forbidden"); break; default: - html_status(400, "Bad request", 0); + cgit_print_error_page(400, "Bad request", "Bad request"); } return; } ctx.page.mimetype = "application/octet-stream"; ctx.page.filename = path; - if (!starts_with(ctx.repo->path, path)) - ctx.page.filename += strlen(ctx.repo->path) + 1; + skip_prefix(path, ctx.repo->path, &ctx.page.filename); + skip_prefix(ctx.page.filename, "/", &ctx.page.filename); cgit_print_http_headers(); html_include(path); } void cgit_clone_info(void) { - if (!ctx.qry.path || strcmp(ctx.qry.path, "refs")) + if (!ctx.qry.path || strcmp(ctx.qry.path, "refs")) { + cgit_print_error_page(400, "Bad request", "Bad request"); return; + } ctx.page.mimetype = "text/plain"; ctx.page.filename = "info/refs"; cgit_print_http_headers(); - for_each_ref(print_ref_info, NULL); + refs_for_each_ref(get_main_ref_store(the_repository), + print_ref_info, NULL); } void cgit_clone_objects(void) { - if (!ctx.qry.path) { - html_status(400, "Bad request", 0); - return; - } + char *p, *path; + + if (!ctx.qry.path) + goto err; if (!strcmp(ctx.qry.path, "info/packs")) { print_pack_info(); return; } - send_file(git_path("objects/%s", ctx.qry.path)); + /* Avoid directory traversal by forbidding "..", but also work around + * other funny business by just specifying a fairly strict format. For + * example, now we don't have to stress out about the Cygwin port. + */ + for (p = ctx.qry.path; *p; ++p) { + if (*p == '.' && *(p + 1) == '.') + goto err; + if (!isalnum(*p) && *p != '/' && *p != '.' && *p != '-') + goto err; + } + + path = repo_git_path(the_repository, "objects/%s", ctx.qry.path); + send_file(path); + free(path); + return; + +err: + cgit_print_error_page(400, "Bad request", "Bad request"); } void cgit_clone_head(void) { - send_file(git_path("%s", "HEAD")); + char *path; + + path = repo_git_path(the_repository, "HEAD"); + send_file(path); + free(path); } |