mirror of
https://github.com/vitalif/viewvc-4intranet
synced 2019-04-16 04:14:59 +03:00
Compare commits
1 Commits
Author | SHA1 | Date | |
---|---|---|---|
![]() |
382ac29ed0 |
12
CHANGES
12
CHANGES
@@ -1,15 +1,3 @@
|
|||||||
Version 1.1.17 (released 25-Oct-2012)
|
|
||||||
|
|
||||||
* fix exception caused by uninitialized variable usage (issue #516)
|
|
||||||
|
|
||||||
Version 1.1.16 (released 24-Oct-2012)
|
|
||||||
|
|
||||||
* security fix: escape "extra" diff info to avoid XSS attack (issue #515)
|
|
||||||
* add 'binary_mime_types' configuration option and handling (issue #510)
|
|
||||||
* fix 'select for diffs' persistence across log pages (issue #512)
|
|
||||||
* remove lock status and filesize check on directories in remote SVN views
|
|
||||||
* fix bogus 'Annotation of' page title for non-annotated view (issue #514)
|
|
||||||
|
|
||||||
Version 1.1.15 (released 22-Jun-2012)
|
Version 1.1.15 (released 22-Jun-2012)
|
||||||
|
|
||||||
* security fix: complete authz support for remote SVN views (issue #353)
|
* security fix: complete authz support for remote SVN views (issue #353)
|
||||||
|
@@ -391,24 +391,6 @@
|
|||||||
##
|
##
|
||||||
#allowed_views = annotate, diff, markup, roots
|
#allowed_views = annotate, diff, markup, roots
|
||||||
|
|
||||||
## Comma-delimited list of MIME content types (with support for fnmatch-
|
|
||||||
## style glob characters) which are considered not-human-readable and for
|
|
||||||
## which ViewVC will neither generate links to, nor support the direct
|
|
||||||
## display of, non-checkout views which carry the file's content (the
|
|
||||||
## 'markup', 'annotate', 'diff', and 'patch' views).
|
|
||||||
##
|
|
||||||
## NOTE: Handling of this option is given priority over ViewVC's
|
|
||||||
## longstanding support for showing web-friendly file formats -- even
|
|
||||||
## binary ones such as "image/jpeg" and "image/gif" -- in the 'markup'
|
|
||||||
## view. Thus, if you add "image/*" to this list, 'markup'-view
|
|
||||||
## display of JPEG, GIF, and PNG images will be disabled.
|
|
||||||
##
|
|
||||||
## Example:
|
|
||||||
## binary_mime_types = application/octet-stream, image/*, application/pdf,
|
|
||||||
## application/vnd*, application/msword, audio/*
|
|
||||||
#
|
|
||||||
#binary_mime_types =
|
|
||||||
|
|
||||||
## authorizer: The name of the ViewVC authorizer plugin to use when
|
## authorizer: The name of the ViewVC authorizer plugin to use when
|
||||||
## authorizing access to repository contents. This value must be the
|
## authorizing access to repository contents. This value must be the
|
||||||
## name of a Python module addressable as vcauth.MODULENAME (most
|
## name of a Python module addressable as vcauth.MODULENAME (most
|
||||||
@@ -579,7 +561,7 @@
|
|||||||
## (Only works well for C source files, otherwise diff's heuristic falls short.)
|
## (Only works well for C source files, otherwise diff's heuristic falls short.)
|
||||||
## ('-p' option to diff)
|
## ('-p' option to diff)
|
||||||
##
|
##
|
||||||
#hr_funout = 1
|
#hr_funout = 0
|
||||||
|
|
||||||
## hr_ignore_white: Ignore whitespace (indendation and stuff) for human
|
## hr_ignore_white: Ignore whitespace (indendation and stuff) for human
|
||||||
## readable diffs.
|
## readable diffs.
|
||||||
|
@@ -112,7 +112,6 @@ class Config:
|
|||||||
_force_multi_value = (
|
_force_multi_value = (
|
||||||
# Configuration values with multiple, comma-separated values.
|
# Configuration values with multiple, comma-separated values.
|
||||||
'allowed_views',
|
'allowed_views',
|
||||||
'binary_mime_types',
|
|
||||||
'custom_log_formatting',
|
'custom_log_formatting',
|
||||||
'cvs_roots',
|
'cvs_roots',
|
||||||
'kv_files',
|
'kv_files',
|
||||||
@@ -402,7 +401,6 @@ class Config:
|
|||||||
self.options.mangle_email_addresses = 0
|
self.options.mangle_email_addresses = 0
|
||||||
self.options.custom_log_formatting = []
|
self.options.custom_log_formatting = []
|
||||||
self.options.default_file_view = "log"
|
self.options.default_file_view = "log"
|
||||||
self.options.binary_mime_types = []
|
|
||||||
self.options.http_expiration_time = 600
|
self.options.http_expiration_time = 600
|
||||||
self.options.generate_etags = 1
|
self.options.generate_etags = 1
|
||||||
self.options.svn_ignore_mimetype = 0
|
self.options.svn_ignore_mimetype = 0
|
||||||
|
@@ -313,17 +313,13 @@ class RemoteSubversionRepository(vclib.Repository):
|
|||||||
rev = self._getrev(rev)
|
rev = self._getrev(rev)
|
||||||
url = self._geturl(path)
|
url = self._geturl(path)
|
||||||
|
|
||||||
# If this is a file, fetch the lock status and size (as of REV)
|
# Use ls3 to fetch the lock status and size (as of REV) for this item.
|
||||||
# for this item.
|
lockinfo = None
|
||||||
lockinfo = size_in_rev = None
|
basename = path_parts and path_parts[-1] or ""
|
||||||
if path_type == vclib.FILE:
|
dirents, locks = list_directory(url, _rev2optrev(rev),
|
||||||
basename = path_parts[-1]
|
|
||||||
list_url = self._geturl(self._getpath(path_parts[:-1]))
|
|
||||||
dirents, locks = list_directory(list_url, _rev2optrev(rev),
|
|
||||||
_rev2optrev(rev), 0, self.ctx)
|
_rev2optrev(rev), 0, self.ctx)
|
||||||
if locks.has_key(basename):
|
if locks.has_key(basename):
|
||||||
lockinfo = locks[basename].owner
|
lockinfo = locks[basename].owner
|
||||||
if dirents.has_key(basename):
|
|
||||||
size_in_rev = dirents[basename].size
|
size_in_rev = dirents[basename].size
|
||||||
|
|
||||||
# Special handling for the 'svn_latest_log' scenario.
|
# Special handling for the 'svn_latest_log' scenario.
|
||||||
|
@@ -14,7 +14,7 @@
|
|||||||
#
|
#
|
||||||
# -----------------------------------------------------------------------
|
# -----------------------------------------------------------------------
|
||||||
|
|
||||||
__version__ = '1.1.17'
|
__version__ = '1.1.15'
|
||||||
|
|
||||||
# this comes from our library; measure the startup time
|
# this comes from our library; measure the startup time
|
||||||
import debug
|
import debug
|
||||||
@@ -24,7 +24,6 @@ debug.t_start('imports')
|
|||||||
# standard modules that we know are in the path or builtin
|
# standard modules that we know are in the path or builtin
|
||||||
import sys
|
import sys
|
||||||
import os
|
import os
|
||||||
import fnmatch
|
|
||||||
import gzip
|
import gzip
|
||||||
import mimetypes
|
import mimetypes
|
||||||
import re
|
import re
|
||||||
@@ -1018,15 +1017,6 @@ def default_view(mime_type, cfg):
|
|||||||
return view_markup
|
return view_markup
|
||||||
return view_checkout
|
return view_checkout
|
||||||
|
|
||||||
def is_binary_file_mime_type(mime_type, cfg):
|
|
||||||
"""Return True iff MIME_TYPE is set and matches one of the binary
|
|
||||||
file mime type patterns in CFG."""
|
|
||||||
if mime_type:
|
|
||||||
for pattern in cfg.options.binary_mime_types:
|
|
||||||
if fnmatch.fnmatch(mime_type, pattern):
|
|
||||||
return True
|
|
||||||
return False
|
|
||||||
|
|
||||||
def get_file_view_info(request, where, rev=None, mime_type=None, pathrev=-1):
|
def get_file_view_info(request, where, rev=None, mime_type=None, pathrev=-1):
|
||||||
"""Return an object holding common hrefs and a viewability flag used
|
"""Return an object holding common hrefs and a viewability flag used
|
||||||
for various views of FILENAME at revision REV whose MIME type is
|
for various views of FILENAME at revision REV whose MIME type is
|
||||||
@@ -1087,11 +1077,6 @@ def get_file_view_info(request, where, rev=None, mime_type=None, pathrev=-1):
|
|||||||
params={'revision': rev},
|
params={'revision': rev},
|
||||||
escape=1)
|
escape=1)
|
||||||
|
|
||||||
is_binary_file = is_binary_file_mime_type(mime_type, request.cfg)
|
|
||||||
if is_binary_file:
|
|
||||||
download_text_href = annotate_href = view_href = None
|
|
||||||
prefer_markup = False
|
|
||||||
else:
|
|
||||||
prefer_markup = default_view(mime_type, request.cfg) == view_markup
|
prefer_markup = default_view(mime_type, request.cfg) == view_markup
|
||||||
|
|
||||||
return _item(view_href=view_href,
|
return _item(view_href=view_href,
|
||||||
@@ -1846,11 +1831,6 @@ def markup_or_annotate(request, is_annotate):
|
|||||||
revision = None
|
revision = None
|
||||||
mime_type, encoding = calculate_mime_type(request, path, rev)
|
mime_type, encoding = calculate_mime_type(request, path, rev)
|
||||||
|
|
||||||
# Is this display blocked by 'binary_mime_types' configuration?
|
|
||||||
if is_binary_file_mime_type(mime_type, cfg):
|
|
||||||
raise debug.ViewVCException('Display of binary file content disabled '
|
|
||||||
'by configuration', '403 Forbidden')
|
|
||||||
|
|
||||||
# Is this a viewable image type?
|
# Is this a viewable image type?
|
||||||
if is_viewable_image(mime_type) \
|
if is_viewable_image(mime_type) \
|
||||||
and 'co' in cfg.options.allowed_views:
|
and 'co' in cfg.options.allowed_views:
|
||||||
@@ -2551,7 +2531,6 @@ def view_log(request):
|
|||||||
sortby = vclib.SORTBY_DEFAULT
|
sortby = vclib.SORTBY_DEFAULT
|
||||||
|
|
||||||
first = last = 0
|
first = last = 0
|
||||||
log_pagestart = None
|
|
||||||
if cfg.options.log_pagesize:
|
if cfg.options.log_pagesize:
|
||||||
log_pagestart = int(request.query_dict.get('log_pagestart', 0))
|
log_pagestart = int(request.query_dict.get('log_pagestart', 0))
|
||||||
total = cfg.options.log_pagesextra * cfg.options.log_pagesize
|
total = cfg.options.log_pagesextra * cfg.options.log_pagesize
|
||||||
@@ -2675,8 +2654,7 @@ def view_log(request):
|
|||||||
if selected_rev != entry.rev:
|
if selected_rev != entry.rev:
|
||||||
entry.sel_for_diff_href = \
|
entry.sel_for_diff_href = \
|
||||||
request.get_url(view_func=view_log,
|
request.get_url(view_func=view_log,
|
||||||
params={'r1': entry.rev,
|
params={'r1': entry.rev},
|
||||||
'log_pagestart': log_pagestart},
|
|
||||||
escape=1)
|
escape=1)
|
||||||
if entry.prev is not None:
|
if entry.prev is not None:
|
||||||
entry.diff_to_prev_href = \
|
entry.diff_to_prev_href = \
|
||||||
@@ -2817,9 +2795,7 @@ def view_log(request):
|
|||||||
|
|
||||||
if cfg.options.log_pagesize:
|
if cfg.options.log_pagesize:
|
||||||
data['log_paging_action'], data['log_paging_hidden_values'] = \
|
data['log_paging_action'], data['log_paging_hidden_values'] = \
|
||||||
request.get_form(params={'log_pagestart': None,
|
request.get_form(params={'log_pagestart': None})
|
||||||
'r1': selected_rev,
|
|
||||||
})
|
|
||||||
data['log_pagestart'] = int(request.query_dict.get('log_pagestart',0))
|
data['log_pagestart'] = int(request.query_dict.get('log_pagestart',0))
|
||||||
data['entries'] = paging_sws(data, 'entries', data['log_pagestart'],
|
data['entries'] = paging_sws(data, 'entries', data['log_pagestart'],
|
||||||
'rev', cfg.options.log_pagesize,
|
'rev', cfg.options.log_pagesize,
|
||||||
@@ -3085,7 +3061,7 @@ class DiffSource:
|
|||||||
return _item(type='header',
|
return _item(type='header',
|
||||||
line_info_left=match.group(1),
|
line_info_left=match.group(1),
|
||||||
line_info_right=match.group(2),
|
line_info_right=match.group(2),
|
||||||
line_info_extra=self._format_text(match.group(3)))
|
line_info_extra=match.group(3))
|
||||||
|
|
||||||
if line[0] == '\\':
|
if line[0] == '\\':
|
||||||
# \ No newline at end of file
|
# \ No newline at end of file
|
||||||
@@ -3300,13 +3276,6 @@ def view_patch(request):
|
|||||||
query_dict = request.query_dict
|
query_dict = request.query_dict
|
||||||
p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request)
|
p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request)
|
||||||
|
|
||||||
mime_type1, encoding1 = calculate_mime_type(request, p1, rev1)
|
|
||||||
mime_type2, encoding2 = calculate_mime_type(request, p2, rev2)
|
|
||||||
if is_binary_file_mime_type(mime_type1, cfg) or \
|
|
||||||
is_binary_file_mime_type(mime_type2, cfg):
|
|
||||||
raise debug.ViewVCException('Display of binary file content disabled '
|
|
||||||
'by configuration', '403 Forbidden')
|
|
||||||
|
|
||||||
# In the absence of a format dictation in the CGI params, we'll let
|
# In the absence of a format dictation in the CGI params, we'll let
|
||||||
# use the configured diff format, allowing 'c' to mean 'c' and
|
# use the configured diff format, allowing 'c' to mean 'c' and
|
||||||
# anything else to mean 'u'.
|
# anything else to mean 'u'.
|
||||||
@@ -3347,13 +3316,6 @@ def view_diff(request):
|
|||||||
query_dict = request.query_dict
|
query_dict = request.query_dict
|
||||||
p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request)
|
p1, p2, rev1, rev2, sym1, sym2 = setup_diff(request)
|
||||||
|
|
||||||
mime_type1, encoding1 = calculate_mime_type(request, p1, rev1)
|
|
||||||
mime_type2, encoding2 = calculate_mime_type(request, p2, rev2)
|
|
||||||
if is_binary_file_mime_type(mime_type1, cfg) or \
|
|
||||||
is_binary_file_mime_type(mime_type2, cfg):
|
|
||||||
raise debug.ViewVCException('Display of binary file content disabled '
|
|
||||||
'by configuration', '403 Forbidden')
|
|
||||||
|
|
||||||
# since templates are in use and subversion allows changes to the dates,
|
# since templates are in use and subversion allows changes to the dates,
|
||||||
# we can't provide a strong etag
|
# we can't provide a strong etag
|
||||||
if check_freshness(request, None, '%s-%s' % (rev1, rev2), weak=1):
|
if check_freshness(request, None, '%s-%s' % (rev1, rev2), weak=1):
|
||||||
|
@@ -9,11 +9,7 @@
|
|||||||
[# ------------------------------------------------------------------------- ]
|
[# ------------------------------------------------------------------------- ]
|
||||||
|
|
||||||
[# setup page definitions]
|
[# setup page definitions]
|
||||||
[is annotation "annotated"]
|
|
||||||
[define page_title]Annotation of /[where][end]
|
|
||||||
[else]
|
|
||||||
[define page_title]Contents of /[where][end]
|
[define page_title]Contents of /[where][end]
|
||||||
[end]
|
|
||||||
[define help_href][docroot]/help_rootview.html[end]
|
[define help_href][docroot]/help_rootview.html[end]
|
||||||
[# end]
|
[# end]
|
||||||
|
|
||||||
|
Reference in New Issue
Block a user