1
0
mirror of https://github.com/vitalif/viewvc-4intranet synced 2019-04-16 04:14:59 +03:00

Compare commits

..

1 Commits

Author SHA1 Message Date
cmpilato
382ac29ed0 Tag the 1.1.15 final release.
git-svn-id: http://viewvc.tigris.org/svn/viewvc/tags/1.1.15@2776 8cb11bc2-c004-0410-86c3-e597b4017df7
2012-06-22 18:43:12 +00:00
6 changed files with 15 additions and 93 deletions

12
CHANGES
View File

@@ -1,15 +1,3 @@
Version 1.1.17 (released 25-Oct-2012)
* fix exception caused by uninitialized variable usage (issue #516)
Version 1.1.16 (released 24-Oct-2012)
* security fix: escape "extra" diff info to avoid XSS attack (issue #515)
* add 'binary_mime_types' configuration option and handling (issue #510)
* fix 'select for diffs' persistence across log pages (issue #512)
* remove lock status and filesize check on directories in remote SVN views
* fix bogus 'Annotation of' page title for non-annotated view (issue #514)
Version 1.1.15 (released 22-Jun-2012) Version 1.1.15 (released 22-Jun-2012)
* security fix: complete authz support for remote SVN views (issue #353) * security fix: complete authz support for remote SVN views (issue #353)

View File

@@ -391,24 +391,6 @@
## ##
#allowed_views = annotate, diff, markup, roots #allowed_views = annotate, diff, markup, roots
## Comma-delimited list of MIME content types (with support for fnmatch-
## style glob characters) which are considered not-human-readable and for
## which ViewVC will neither generate links to, nor support the direct
## display of, non-checkout views which carry the file's content (the
## 'markup', 'annotate', 'diff', and 'patch' views).
##
## NOTE: Handling of this option is given priority over ViewVC's
## longstanding support for showing web-friendly file formats -- even
## binary ones such as "image/jpeg" and "image/gif" -- in the 'markup'
## view. Thus, if you add "image/*" to this list, 'markup'-view
## display of JPEG, GIF, and PNG images will be disabled.
##
## Example:
## binary_mime_types = application/octet-stream, image/*, application/pdf,
## application/vnd*, application/msword, audio/*
#
#binary_mime_types =
## authorizer: The name of the ViewVC authorizer plugin to use when ## authorizer: The name of the ViewVC authorizer plugin to use when
## authorizing access to repository contents. This value must be the ## authorizing access to repository contents. This value must be the
## name of a Python module addressable as vcauth.MODULENAME (most ## name of a Python module addressable as vcauth.MODULENAME (most
@@ -579,7 +561,7 @@
## (Only works well for C source files, otherwise diff's heuristic falls short.) ## (Only works well for C source files, otherwise diff's heuristic falls short.)
## ('-p' option to diff) ## ('-p' option to diff)
## ##
#hr_funout = 1 #hr_funout = 0
## hr_ignore_white: Ignore whitespace (indendation and stuff) for human ## hr_ignore_white: Ignore whitespace (indendation and stuff) for human
## readable diffs. ## readable diffs.

View File

@@ -112,7 +112,6 @@ class Config:
_force_multi_value = ( _force_multi_value = (
# Configuration values with multiple, comma-separated values. # Configuration values with multiple, comma-separated values.
'allowed_views', 'allowed_views',
'binary_mime_types',
'custom_log_formatting', 'custom_log_formatting',
'cvs_roots', 'cvs_roots',
'kv_files', 'kv_files',
@@ -402,7 +401,6 @@ class Config:
self.options.mangle_email_addresses = 0 self.options.mangle_email_addresses = 0
self.options.custom_log_formatting = [] self.options.custom_log_formatting = []
self.options.default_file_view = "log" self.options.default_file_view = "log"
self.options.binary_mime_types = []
self.options.http_expiration_time = 600 self.options.http_expiration_time = 600
self.options.generate_etags = 1 self.options.generate_etags = 1
self.options.svn_ignore_mimetype = 0 self.options.svn_ignore_mimetype = 0

View File

@@ -313,17 +313,13 @@ class RemoteSubversionRepository(vclib.Repository):
rev = self._getrev(rev) rev = self._getrev(rev)
url = self._geturl(path) url = self._geturl(path)
# If this is a file, fetch the lock status and size (as of REV) # Use ls3 to fetch the lock status and size (as of REV) for this item.
# for this item. lockinfo = None
lockinfo = size_in_rev = None basename = path_parts and path_parts[-1] or ""
if path_type == vclib.FILE: dirents, locks = list_directory(url, _rev2optrev(rev),
basename = path_parts[-1]
list_url = self._geturl(self._getpath(path_parts[:-1]))
dirents, locks = list_directory(list_url, _rev2optrev(rev),
_rev2optrev(rev), 0, self.ctx) _rev2optrev(rev), 0, self.ctx)
if locks.has_key(basename): if locks.has_key(basename):
lockinfo = locks[basename].owner lockinfo = locks[basename].owner
if dirents.has_key(basename):
size_in_rev = dirents[basename].size size_in_rev = dirents[basename].size
# Special handling for the 'svn_latest_log' scenario. # Special handling for the 'svn_latest_log' scenario.

View File

@@ -14,7 +14,7 @@
# #
# ----------------------------------------------------------------------- # -----------------------------------------------------------------------
__version__ = '1.1.17' __version__ = '1.1.15'
# this comes from our library; measure the startup time # this comes from our library; measure the startup time
import debug import debug
@@ -24,7 +24,6 @@ debug.t_start('imports')
# standard modules that we know are in the path or builtin # standard modules that we know are in the path or builtin
import sys import sys
import os import os
import fnmatch
import gzip import gzip
import mimetypes import mimetypes
import re import re
@@ -1018,15 +1017,6 @@ def default_view(mime_type, cfg):
return view_markup return view_markup
return view_checkout return view_checkout
def is_binary_file_mime_type(mime_type, cfg):
"""Return True iff MIME_TYPE is set and matches one of the binary
file mime type patterns in CFG."""
if mime_type:
for pattern in cfg.options.binary_mime_types:
if fnmatch.fnmatch(mime_type, pattern):
return True
return False
def get_file_view_info(request, where, rev=None, mime_type=None, pathrev=-1): def get_file_view_info(request, where, rev=None, mime_type=None, pathrev=-1):
"""Return an object holding common hrefs and a viewability flag used """Return an object holding common hrefs and a viewability flag used
for various views of FILENAME at revision REV whose MIME type is for various views of FILENAME at revision REV whose MIME type is
@@ -1087,11 +1077,6 @@ def get_file_view_info(request, where, rev=None, mime_type=None, pathrev=-1):
params={'revision': rev}, params={'revision': rev},
escape=1) escape=1)
is_binary_file = is_binary_file_mime_type(mime_type, request.cfg)
if is_binary_file:
download_text_href = annotate_href = view_href = None
prefer_markup = False
else:
prefer_markup = default_view(mime_type, request.cfg) == view_markup prefer_markup = default_view(mime_type, request.cfg) == view_markup
return _item(view_href=view_href, return _item(view_href=view_href,
@@ -1846,11 +1831,6 @@ def markup_or_annotate(request, is_annotate):
revision = None revision = None
mime_type, encoding = calculate_mime_type(request, path, rev) mime_type, encoding = calculate_mime_type(request, path, rev)
# Is this display blocked by 'binary_mime_types' configuration?
if is_binary_file_mime_type(mime_type, cfg):
raise debug.ViewVCException('Display of binary file content disabled '
'by configuration', '403 Forbidden')
# Is this a viewable image type? # Is this a viewable image type?
if is_viewable_image(mime_type) \ if is_viewable_image(mime_type) \
and 'co' in cfg.options.allowed_views: and 'co' in cfg.options.allowed_views:
@@ -2551,7 +2531,6 @@ def view_log(request):
sortby = vclib.SORTBY_DEFAULT sortby = vclib.SORTBY_DEFAULT
first = last = 0 first = last = 0
log_pagestart = None
if cfg.options.log_pagesize: if cfg.options.log_pagesize:
log_pagestart = int(request.query_dict.get('log_pagestart', 0)) log_pagestart = int(request.query_dict.get('log_pagestart', 0))
total = cfg.options.log_pagesextra * cfg.options.log_pagesize total = cfg.options.log_pagesextra * cfg.options.log_pagesize
@@ -2675,8 +2654,7 @@ def view_log(request):
if selected_rev != entry.rev: if selected_rev != entry.rev:
entry.sel_for_diff_href = \ entry.sel_for_diff_href = \
request.get_url(view_func=view_log, request.get_url(view_func=view_log,
params={'r1': entry.rev, params={'r1': entry.rev},
'log_pagestart': log_pagestart},
escape=1) escape=1)
if entry.prev is not None: if entry.prev is not None:
entry.diff_to_prev_href = \ entry.diff_to_prev_href = \
@@ -2817,9 +2795,7 @@ def view_log(request):
if cfg.options.log_pagesize: if cfg.options.log_pagesize:
data['log_paging_action'], data['log_paging_hidden_values'] = \ data['log_paging_action'], data['log_paging_hidden_values'] = \
request.get_form(params={'log_pagestart': None, request.get_form(params={'log_pagestart': None})
'r1': selected_rev,
})
data['log_pagestart'] = int(request.query_dict.get('log_pagestart',0)) data['log_pagestart'] = int(request.query_dict.get('log_pagestart',0))
data['entries'] = paging_sws(data, 'entries', data['log_pagestart'], data['entries'] = paging_sws(data, 'entries', data['log_pagestart'],
'rev', cfg.options.log_pagesize, 'rev', cfg.options.log_pagesize,
@@ -3085,7 +3061,7 @@ class DiffSource:
return _item(type='header', return _item(type='header',
line_info_left=match.group(1), line_info_left=match.group(1),
line_info_right=match.group(2), line_info_right=match.group(2),
line_info_extra=self._format_text(match.group(3))) line_info_extra=match.group(3))
if line[0] == '\\': if line[0] == '\\':
# \ No newline at end of file # \ No newline at end of file
@@ -3300,13 +3276,6 @@ def view_patch(request):
query_dict = request.query_dict query_dict = request.query_dict
p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request) p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request)
mime_type1, encoding1 = calculate_mime_type(request, p1, rev1)
mime_type2, encoding2 = calculate_mime_type(request, p2, rev2)
if is_binary_file_mime_type(mime_type1, cfg) or \
is_binary_file_mime_type(mime_type2, cfg):
raise debug.ViewVCException('Display of binary file content disabled '
'by configuration', '403 Forbidden')
# In the absence of a format dictation in the CGI params, we'll let # In the absence of a format dictation in the CGI params, we'll let
# use the configured diff format, allowing 'c' to mean 'c' and # use the configured diff format, allowing 'c' to mean 'c' and
# anything else to mean 'u'. # anything else to mean 'u'.
@@ -3347,13 +3316,6 @@ def view_diff(request):
query_dict = request.query_dict query_dict = request.query_dict
p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request) p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request)
mime_type1, encoding1 = calculate_mime_type(request, p1, rev1)
mime_type2, encoding2 = calculate_mime_type(request, p2, rev2)
if is_binary_file_mime_type(mime_type1, cfg) or \
is_binary_file_mime_type(mime_type2, cfg):
raise debug.ViewVCException('Display of binary file content disabled '
'by configuration', '403 Forbidden')
# since templates are in use and subversion allows changes to the dates, # since templates are in use and subversion allows changes to the dates,
# we can't provide a strong etag # we can't provide a strong etag
if check_freshness(request, None, '%s-%s' % (rev1, rev2), weak=1): if check_freshness(request, None, '%s-%s' % (rev1, rev2), weak=1):

View File

@@ -9,11 +9,7 @@
[# ------------------------------------------------------------------------- ] [# ------------------------------------------------------------------------- ]
[# setup page definitions] [# setup page definitions]
[is annotation "annotated"]
[define page_title]Annotation of /[where][end]
[else]
[define page_title]Contents of /[where][end] [define page_title]Contents of /[where][end]
[end]
[define help_href][docroot]/help_rootview.html[end] [define help_href][docroot]/help_rootview.html[end]
[# end] [# end]