gitweb fix validating pg (page) parameter

[Gitweb] / gitweb.perl

diff --git a/gitweb.perl b/gitweb.perl
index b5a6bcb09fa1161c3e061ec48c5be04859fc7289b71fd11bdcb45f6e1a3b8f73..8c0e4731921c5df05292aec634ca0efcc093e0f8c52009d5e5bd9117b4406905 100755 (executable)
--- a/gitweb.perl
+++ b/gitweb.perl
@@ -54,6 +54,13 @@ our $favicon = "++GITWEB_FAVICON++";
 # source of projects list
 our $projects_list = "++GITWEB_LIST++";
 
+# show repository only if this file exists
+# (only effective if this variable evaluates to true)
+our $export_ok = "++GITWEB_EXPORT_OK++";
+
+# only allow viewing of repositories also shown on the overview page
+our $strict_export = "++GITWEB_STRICT_EXPORT++";
+
 # list of git base URLs used for URL to where fetch project from,
 # i.e. full URL is "$git_base_url/$project"
 our @git_base_url_list = ("++GITWEB_BASE_URL++");
@@ -182,9 +189,6 @@ do $GITWEB_CONFIG if -e $GITWEB_CONFIG;
 # version of the core git binary
 our $git_version = qx($GIT --version) =~ m/git version (.*)$/ ? $1 : "unknown";
 
-# path to the current git repository
-our $git_dir;
-
 $projects_list ||= $projectroot;
 
 # ======================================================================
@@ -200,7 +204,9 @@ our $project = $cgi->param('p');
 if (defined $project) {
        if (!validate_input($project) ||
            !(-d "$projectroot/$project") ||
-           !(-e "$projectroot/$project/HEAD")) {
+           !(-e "$projectroot/$project/HEAD") ||
+           ($export_ok && !(-e "$projectroot/$project/$export_ok")) ||
+           ($strict_export && !project_in_list($project))) {
                undef $project;
                die_error(undef, "No such project");
        }
@@ -250,7 +256,7 @@ if (defined $hash_parent_base) {
 
 our $page = $cgi->param('pg');
 if (defined $page) {
-       if ($page =~ m/[^0-9]$/) {
+       if ($page =~ m/[^0-9]/) {
                die_error(undef, "Invalid page parameter");
        }
 }
@@ -264,30 +270,41 @@ if (defined $searchtext) {
 }
 
 # now read PATH_INFO and use it as alternative to parameters
-our $path_info = $ENV{"PATH_INFO"};
-$path_info =~ s|^/||;
-$path_info =~ s|/$||;
-if (validate_input($path_info) && !defined $project) {
+sub evaluate_path_info {
+       return if defined $project;
+       my $path_info = $ENV{"PATH_INFO"};
+       return if !$path_info;
+       $path_info =~ s,(^/|/$),,gs;
+       $path_info = validate_input($path_info);
+       return if !$path_info;
        $project = $path_info;
        while ($project && !-e "$projectroot/$project/HEAD") {
                $project =~ s,/*[^/]*$,,;
        }
-       if (defined $project) {
-               $project = undef unless $project;
+       if (!$project ||
+           ($export_ok && !-e "$projectroot/$project/$export_ok") ||
+           ($strict_export && !project_in_list($project))) {
+               undef $project;
+               return;
        }
+       # do not change any parameters if an action is given using the query string
+       return if $action;
        if ($path_info =~ m,^$project/([^/]+)/(.+)$,) {
                # we got "project.git/branch/filename"
                $action    ||= "blob_plain";
-               $hash_base ||= $1;
-               $file_name ||= $2;
+               $hash_base ||= validate_input($1);
+               $file_name ||= validate_input($2);
        } elsif ($path_info =~ m,^$project/([^/]+)$,) {
                # we got "project.git/branch"
                $action ||= "shortlog";
-               $hash   ||= $1;
+               $hash   ||= validate_input($1);
        }
 }
+evaluate_path_info();
 
-$git_dir = "$projectroot/$project";
+# path to the current git repository
+our $git_dir;
+$git_dir = "$projectroot/$project" if $project;
 
 # dispatch
 my %actions = (
@@ -422,6 +439,12 @@ sub untabify {
        return $line;
 }
 
+sub project_in_list {
+       my $project = shift;
+       my @list = git_get_projects_list();
+       return @list && scalar(grep { $_->{'path'} eq $project } @list);
+}
+
 ## ----------------------------------------------------------------------
 ## HTML aware string manipulation
 
@@ -734,7 +757,8 @@ sub git_get_projects_list {
 
                                my $subdir = substr($File::Find::name, $pfxlen + 1);
                                # we check related file in $projectroot
-                               if (-e "$projectroot/$subdir/HEAD") {
+                               if (-e "$projectroot/$subdir/HEAD" && (!$export_ok ||
+                                   -e "$projectroot/$subdir/$export_ok")) {
                                        push @list, { path => $subdir };
                                        $File::Find::prune = 1;
                                }
@@ -755,7 +779,8 @@ sub git_get_projects_list {
                        if (!defined $path) {
                                next;
                        }
-                       if (-e "$projectroot/$path/HEAD") {
+                       if (-e "$projectroot/$path/HEAD" && (!$export_ok ||
+                           -e "$projectroot/$path/$export_ok")) {
                                my $pr = {
                                        path => $path,
                                        owner => decode("utf8", $owner, Encode::FB_DEFAULT),