=================================================================== RCS file: /cvs/cvsweb/cvsweb.cgi,v retrieving revision 1.1.1.32 retrieving revision 1.1.1.35 diff -u -p -r1.1.1.32 -r1.1.1.35 --- cvsweb/cvsweb.cgi 2002/07/07 04:31:41 1.1.1.32 +++ cvsweb/cvsweb.cgi 2002/09/30 19:43:49 1.1.1.35 @@ -3,14 +3,15 @@ # cvsweb - a CGI interface to CVS trees. # # Written in their spare time by -# Bill Fenner (original work) -# extended by Henner Zeller , -# Henrik Nordstrom -# Ken Coar -# Dick Balaska -# Akinori MUSHA -# Jens-Uwe Mager -# Ville Skyttä +# Bill Fenner (original work) +# extended by Henner Zeller , +# Henrik Nordstrom +# Ken Coar +# Dick Balaska +# Akinori MUSHA +# Jens-Uwe Mager +# Ville Skyttä +# Vassilii Khachaturov # # Based on: # * Bill Fenners cvsweb.cgi revision 1.28 available from: @@ -44,9 +45,10 @@ # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF # SUCH DAMAGE. # -# $FreeBSD: projects/cvsweb/cvsweb.cgi,v 1.112 2002/07/06 18:15:19 scop Exp $ +# FreeBSD: projects/cvsweb/cvsweb.cgi,v 1.119 2002/07/23 13:58:32 scop Exp # $zId: cvsweb.cgi,v 1.112 2001/07/24 13:03:16 hzeller Exp $ # $Idaemons: /home/cvs/cvsweb/cvsweb.cgi,v 1.84 2001/10/07 20:50:10 knu Exp $ +# $FreeBSD: www/en/cgi/cvsweb.cgi,v 1.86 2002/09/26 22:18:25 scop Exp $ # ### @@ -148,7 +150,7 @@ sub forbidden_module($); ##### Start of Configuration Area ######## delete $ENV{PATH}; -$cvsweb_revision = '2.0.4'; +$cvsweb_revision = '2.0.5'; use File::Basename (); @@ -234,6 +236,18 @@ $LOG_REVSEPARATOR = q/^-{28}$/; }, ); +$cgi_style::hsty_base = 'http://www.FreeBSD.org'; +$_ = q$FreeBSD: www/en/cgi/cvsweb.cgi,v 1.86 2002/09/26 22:18:25 scop Exp $; +@_ = split; +$cgi_style::hsty_date = "@_[3,4]"; + +# warningproof +0 if $cgi_style::hsty_base ne $cgi_style::hsty_date; + +package cgi_style; +require "$main::mydir/cgi-style.pl"; +package main; + $HTML_DOCTYPE = ''; @@ -343,7 +357,8 @@ $input{only_with_tag} = $input{only_on_branch} # Prevent cross-site scripting foreach (@unsafevars) { - if (defined($input{$_}) && $input{$_} =~ /[^\w\-.]/) { + # Colons are needed in diffs between tags. + if (defined($input{$_}) && $input{$_} =~ /[^\w\-.:]/) { fatal("500 Internal Error", 'Malformed query (%s=%s)', $_, $input{$_}); @@ -932,6 +947,12 @@ if (-d $fullname) { } $dirrow++; } elsif (s/,v$//) { + + # Skip forbidden files now so we'll give no hint + # about their existence. This should probably have + # been done earlier, but it's straightforward here. + next if forbidden_file("$fullname/$_"); + $fileurl = ($attic ? "Attic/" : "") . urlencode($_); $url = './' . $fileurl . $query; my $rev = ''; @@ -1104,6 +1125,13 @@ if (-d $fullname) { # View Files ############################### elsif (-f $fullname . ',v') { + + if (forbidden_file($fullname)) { + fatal('403 Forbidden', + 'Access forbidden. This file is mentioned in @ForbiddenFiles'); + return; + } + if (defined($input{'rev'}) || $doCheckout) { &doCheckout($fullname, $input{'rev'}); gzipclose(); @@ -1251,6 +1279,11 @@ sub findLastModifiedSubdirs(@) { $filename = "$dirname/$filename"; my ($file) = "$fullname/$filename"; next if ($filename !~ /,v$/ || !-f $file); + + # Skip forbidden files. + (my $f = $file) =~ s/,v$//; + next if forbidden_file($f); + $filename =~ s/,v$//; my $modtime = -M $file; @@ -1587,12 +1620,6 @@ sub doAnnotate($$) { $ENV{QUERY_STRING}); } - if (&forbidden_file($fullname)) { - fatal("403 Forbidden", - 'Access forbidden. This file is mentioned in @ForbiddenFiles'); - return; - } - ($pathname = $where) =~ s/(Attic\/)?[^\/]*$//; ($filename = $where) =~ s/^.*\///; @@ -1777,12 +1804,6 @@ sub doCheckout($$) { $ENV{QUERY_STRING}); } - if (&forbidden_file($fullname)) { - fatal("403 Forbidden", - 'Access forbidden. This file is mentioned in @ForbiddenFiles'); - return; - } - # get mimetype if (defined($input{"content-type"}) && ($input{"content-type"} =~ /\S\/\S/)) @@ -3317,10 +3338,10 @@ sub chooseCVSRoot() { print "CVS Root: [$cvstree]"; } - print "