# HG changeset patch
# User Yuya Nishihara <y...@tcha.org>
# Date 1535289489 -32400
# Sun Aug 26 22:18:09 2018 +0900
# Node ID 70d6fff1bccfe8760f06bc92ca0b23a61c3ddca9
# Parent 61b6dff6e23fde7831422b5787430a32003a4d33
hgweb: do not audit URL path as working-directory path
Since hgweb is an interface to repository data, we don't need to prohibit
any paths conflicting within the filesystem. Still an access to working
files is audited by filectx.
diff --git a/mercurial/hgweb/webutil.py b/mercurial/hgweb/webutil.py
--- a/mercurial/hgweb/webutil.py
+++ b/mercurial/hgweb/webutil.py
@@ -320,7 +320,8 @@ def branchentries(repo, stripecount, lim
def cleanpath(repo, path):
path = path.lstrip('/')
- return pathutil.canonpath(repo.root, '', path)
+ auditor = pathutil.pathauditor(repo.root, realfs=False)
+ return pathutil.canonpath(repo.root, '', path, auditor=auditor)
def changectx(repo, req):
changeid = "tip"
diff --git a/tests/test-hgwebdir.t b/tests/test-hgwebdir.t
--- a/tests/test-hgwebdir.t
+++ b/tests/test-hgwebdir.t
@@ -1231,14 +1231,15 @@ Test subrepositories inside intermediate
f2
-Test accessing file that is shadowed by another repository
+Test accessing file that could be shadowed by another repository if the URL
+path were audited as a working-directory path:
$ get-with-headers.py localhost:$HGPORT1
'rcoll/notrepo/f/file/tip/f3/file?style=raw'
- 403 Forbidden
-
+ 200 Script output follows
- error: path 'f3/file' is inside nested repo 'f3'
- [1]
+ f3/file
+
+Test accessing working-directory file that is shadowed by another repository
$ get-with-headers.py localhost:$HGPORT1
'rcoll/notrepo/f/file/ffffffffffff/f3/file?style=raw'
403 Forbidden
_______________________________________________
Mercurial-devel mailing list
Mercurial-devel@mercurial-scm.org
https://www.mercurial-scm.org/mailman/listinfo/mercurial-devel
