75 lines
2.6 KiB
Diff
75 lines
2.6 KiB
Diff
From 2813e6cef24a8b363a97ea0c86bf4494fc453f32 Mon Sep 17 00:00:00 2001
|
|
From: Lea Wiemann <lewiemann@gmail.com>
|
|
Date: Tue, 17 Jun 2008 23:46:35 +0200
|
|
Subject: [PATCH 2/2] gitweb: quote commands properly when calling the shell
|
|
|
|
This eliminates the function git_cmd_str, which was used for composing
|
|
command lines, and adds a quote_command function, which quotes all of
|
|
its arguments (as in quote.c).
|
|
|
|
Signed-off-by: Lea Wiemann <LeWiemann@gmail.com>
|
|
Signed-off-by: Junio C Hamano <gitster@pobox.com>
|
|
---
|
|
gitweb/gitweb.perl | 24 ++++++++++++++----------
|
|
1 files changed, 14 insertions(+), 10 deletions(-)
|
|
|
|
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
|
|
index e011393..bd50c07 100755
|
|
--- a/gitweb/gitweb.perl
|
|
+++ b/gitweb/gitweb.perl
|
|
@@ -1396,9 +1396,13 @@ sub git_cmd {
|
|
return $GIT, '--git-dir='.$git_dir;
|
|
}
|
|
|
|
-# returns path to the core git executable and the --git-dir parameter as string
|
|
-sub git_cmd_str {
|
|
- return join(' ', git_cmd());
|
|
+# quote the given arguments for passing them to the shell
|
|
+# quote_command("command", "arg 1", "arg with ' and ! characters")
|
|
+# => "'command' 'arg 1' 'arg with '\'' and '\!' characters'"
|
|
+# Try to avoid using this function wherever possible.
|
|
+sub quote_command {
|
|
+ return join(' ',
|
|
+ map( { my $a = $_; $a =~ s/(['!])/'\\$1'/g; "'$a'" } @_ ));
|
|
}
|
|
|
|
# get HEAD ref of given project as hash
|
|
@@ -4477,7 +4481,6 @@ sub git_snapshot {
|
|
$hash = git_get_head_hash($project);
|
|
}
|
|
|
|
- my $git_command = git_cmd_str();
|
|
my $name = $project;
|
|
$name =~ s,([^/])/*\.git$,$1,;
|
|
$name = basename($name);
|
|
@@ -4485,11 +4488,12 @@ sub git_snapshot {
|
|
$name =~ s/\047/\047\\\047\047/g;
|
|
my $cmd;
|
|
$filename .= "-$hash$known_snapshot_formats{$format}{'suffix'}";
|
|
- $cmd = "$git_command archive " .
|
|
- "--format=$known_snapshot_formats{$format}{'format'} " .
|
|
- "--prefix=\'$name\'/ $hash";
|
|
+ $cmd = quote_command(
|
|
+ git_cmd(), 'archive',
|
|
+ "--format=$known_snapshot_formats{$format}{'format'}",
|
|
+ "--prefix=$name/", $hash);
|
|
if (exists $known_snapshot_formats{$format}{'compressor'}) {
|
|
- $cmd .= ' | ' . join ' ', @{$known_snapshot_formats{$format}{'compressor'}};
|
|
+ $cmd .= ' | ' . quote_command(@{$known_snapshot_formats{$format}{'compressor'}});
|
|
}
|
|
|
|
print $cgi->header(
|
|
@@ -4702,8 +4706,8 @@ sub git_object {
|
|
if ($hash || ($hash_base && !defined $file_name)) {
|
|
my $object_id = $hash || $hash_base;
|
|
|
|
- my $git_command = git_cmd_str();
|
|
- open my $fd, "-|", "$git_command cat-file -t $object_id 2>/dev/null"
|
|
+ open my $fd, "-|", quote_command(
|
|
+ git_cmd(), 'cat-file', '-t', $object_id) . ' 2> /dev/null'
|
|
or die_error('404 Not Found', "Object does not exist");
|
|
$type = <$fd>;
|
|
chomp $type;
|
|
--
|
|
1.6.1
|
|
|