This commit was manufactured by cvs2svn to create tag 'V0_9_4'.

git-svn-id: http://viewvc.tigris.org/svn/viewvc/tags/V0_9_4@1076 8cb11bc2-c004-0410-86c3-e597b4017df7

CHANGES

@@ -1,8 +1,12 @@
+Version 0.9.4 (released 17-Aug-2005)
+
+  * security fix: omit forbidden/hidden modules from query results.
+
 Version 0.9.3 (released 17-May-2005)
 
   * security fix: disallow bad "content-type" input [CAN-2004-1062]
   * security fix: disallow bad "sortby" and "cvsroot" input [CAN-2002-0771]
-  * security fix: omit forbidden/hidden modules from tarballs [CAN-2002-0771]
+  * security fix: omit forbidden/hidden modules from tarballs [CAN-2004-0915]
 
 Version 0.9.2 (released 15-Jan-2001)
 

lib/query.py

@@ -295,6 +295,12 @@ def build_commit(desc, files):
         ob.desc = ' '
 
     for commit in files:
+        dir_parts = filter(None, string.split(commit.GetDirectory(), '/'))
+        if dir_parts \
+               and ((dir_parts[0] == 'CVSROOT' and cfg.options.hide_cvsroot) \
+                    or cfg.is_forbidden(dir_parts[0])):
+            continue
+        
         ctime = commit.GetTime()
         if not ctime:
             ctime = "&nbsp";

lib/viewcvs.py

@@ -25,7 +25,7 @@
 # -----------------------------------------------------------------------
 #
 
-__version__ = '0.9.3'
+__version__ = '0.9.4'
 
 #########################################################################
 #

website/index.html

@@ -13,7 +13,7 @@
       </td>
       <td align=center valign=top bgcolor="white" width="1%">
 	<b>Quickstart:</b>
-	<a href="viewcvs-0.9.3.tar.gz">download</a>
+	<a href="viewcvs-0.9.4.tar.gz">download</a>
       </td>
       <td width="1%"><a href="http://sourceforge.net/"><img border=0
 	    src="http://sourceforge.net/sflogo.php?group_id=18760&type=1"></a><br><a href="http://sourceforge.net/projects/viewcvs/">ViewCVS&nbsp;project&nbsp;page</a>
@@ -210,10 +210,10 @@
       The software is available for download:
     </p>
     <blockquote>
-      <a href="viewcvs-0.9.3.tar.gz">Version 0.9.3 of ViewCVS as a gzipped
+      <a href="viewcvs-0.9.4.tar.gz">Version 0.9.4 of ViewCVS as a gzipped
       tar</a>
       <br>
-      <a href="viewcvs-0.9.3.zip">Version 0.9.3 of ViewCVS as a ZIP
+      <a href="viewcvs-0.9.4.zip">Version 0.9.4 of ViewCVS as a ZIP
       file</a>
     </blockquote>
     <p>