X-Git-Url: https://git.ladys.computer/Gitweb/blobdiff_plain/315cc1be722664043b30df1c3ae440e2f8886f9e9793b9812d099cc75783ebdb..4fbcadea1e38491f95abe4219c3ebd23249b7cbbd7df3290917318d3054ab673:/gitweb.cgi diff --git a/gitweb.cgi b/gitweb.cgi index 871ad1f..67345d6 100755 --- a/gitweb.cgi +++ b/gitweb.cgi @@ -1,32 +1,36 @@ #!/usr/bin/perl -# gitweb.pl - simple web interface to track changes in git repositories +# gitweb - simple web interface to track changes in git repositories # # (C) 2005, Kay Sievers # (C) 2005, Christian Gierke # -# This program is licensed under the GPL v2, or a later version +# This program is licensed under the GPLv2 use strict; use warnings; -use CGI qw(:standard :escapeHTML); +use CGI qw(:standard :escapeHTML -nosticky); +use CGI::Util qw(unescape); use CGI::Carp qw(fatalsToBrowser); +use Encode; use Fcntl ':mode'; +binmode STDOUT, ':utf8'; my $cgi = new CGI; -my $version = "143"; +my $version = "253"; my $my_url = $cgi->url(); my $my_uri = $cgi->url(-absolute => 1); -my $rss_link = ""; +my $rss_link = ""; # absolute fs-path which will be prepended to the project path -my $projectroot = "/pub/scm"; +#my $projectroot = "/pub/scm"; +my $projectroot = "/home/kay/public_html/pub/scm"; # location of the git-core binaries my $gitbin = "/usr/bin"; # location for temporary files needed for diffs -my $gittmp = "/tmp/gitweb"; +my $git_temp = "/tmp/gitweb"; # target of the home link on top of all pages my $home_link = $my_uri; @@ -35,33 +39,38 @@ my $home_link = $my_uri; my $home_text = "indextext.html"; # source of projects list -#my $projects_list = $projectroot; -my $projects_list = "index/index.txt"; +#my $projects_list = $projectroot; +my $projects_list = "index/index.aux"; # input validation and dispatch my $action = $cgi->param('a'); if (defined $action) { - if ($action =~ m/[^0-9a-zA-Z\.\-]+/) { + if ($action =~ m/[^0-9a-zA-Z\.\-_]/) { undef $action; die_error(undef, "Invalid action parameter."); } if ($action eq "git-logo.png") { git_logo(); exit; + } elsif ($action eq "opml") { + git_opml(); + exit; + } +} + +my $order = $cgi->param('o'); +if (defined $order) { + if ($order =~ m/[^0-9a-zA-Z_]/) { + undef $order; + die_error(undef, "Invalid order parameter."); } -} else { - $action = "summary"; } my $project = $cgi->param('p'); if (defined $project) { - if ($project =~ m/(^|\/)(|\.|\.\.)($|\/)/) { - undef $project; - die_error(undef, "Non-canonical project parameter."); - } - if ($project =~ m/[^a-zA-Z0-9_\.\/\-\+\#\~]/) { - undef $project; - die_error(undef, "Invalid character in project parameter."); + $project = validate_input($project); + if (!defined($project)) { + die_error(undef, "Invalid project parameter."); } if (!(-d "$projectroot/$project")) { undef $project; @@ -71,9 +80,9 @@ if (defined $project) { undef $project; die_error(undef, "No such project."); } - $rss_link = ""; - $ENV{'GIT_OBJECT_DIRECTORY'} = "$projectroot/$project/objects"; - $ENV{'SHA1_FILE_DIRECTORY'} = "$projectroot/$project/objects"; + $rss_link = ""; + $ENV{'GIT_DIR'} = "$projectroot/$project"; } else { git_project_list(); exit; @@ -81,51 +90,83 @@ if (defined $project) { my $file_name = $cgi->param('f'); if (defined $file_name) { - if ($file_name =~ m/(^|\/)(|\.|\.\.)($|\/)/) { - undef $file_name; - die_error(undef, "Non-canonical file parameter."); - } - if ($file_name =~ m/[^a-zA-Z0-9_\.\/\-\+\#\~\:\!]/) { - undef $file_name; - die_error(undef, "Invalid character in file parameter."); + $file_name = validate_input($file_name); + if (!defined($file_name)) { + die_error(undef, "Invalid file parameter."); } } my $hash = $cgi->param('h'); -if (defined $hash && !($hash =~ m/^[0-9a-fA-F]{40}$/)) { - undef $hash; - die_error(undef, "Invalid hash parameter."); +if (defined $hash) { + $hash = validate_input($hash); + if (!defined($hash)) { + die_error(undef, "Invalid hash parameter."); + } } my $hash_parent = $cgi->param('hp'); -if (defined $hash_parent && !($hash_parent =~ m/^[0-9a-fA-F]{40}$/)) { - undef $hash_parent; - die_error(undef, "Invalid hash_parent parameter."); +if (defined $hash_parent) { + $hash_parent = validate_input($hash_parent); + if (!defined($hash_parent)) { + die_error(undef, "Invalid hash parent parameter."); + } } my $hash_base = $cgi->param('hb'); -if (defined $hash_base && !($hash_base =~ m/^[0-9a-fA-F]{40}$/)) { - undef $hash_base; - die_error(undef, "Invalid parent hash parameter."); +if (defined $hash_base) { + $hash_base = validate_input($hash_base); + if (!defined($hash_base)) { + die_error(undef, "Invalid hash base parameter."); + } +} + +my $page = $cgi->param('pg'); +if (defined $page) { + if ($page =~ m/[^0-9]$/) { + undef $page; + die_error(undef, "Invalid page parameter."); + } +} + +my $searchtext = $cgi->param('s'); +if (defined $searchtext) { + if ($searchtext =~ m/[^a-zA-Z0-9_\.\/\-\+\:\@ ]/) { + undef $searchtext; + die_error(undef, "Invalid search parameter."); + } + $searchtext = quotemeta $searchtext; } -my $time_back = $cgi->param('t'); -if (defined $time_back) { - if ($time_back =~ m/^[^0-9]+$/) { - undef $time_back; - die_error(undef, "Invalid time parameter."); +sub validate_input { + my $input = shift; + + if ($input =~ m/^[0-9a-fA-F]{40}$/) { + return $input; + } + if ($input =~ m/(^|\/)(|\.|\.\.)($|\/)/) { + return undef; } + if ($input =~ m/[^a-zA-Z0-9_ \.\/\-\+\#\~]/) { + return undef; + } + return $input; } -if ($action eq "summary") { +if (!defined $action || $action eq "summary") { git_summary(); exit; +} elsif ($action eq "heads") { + git_heads(); + exit; } elsif ($action eq "tags") { git_tags(); exit; } elsif ($action eq "blob") { git_blob(); exit; +} elsif ($action eq "blob_plain") { + git_blob_plain(); + exit; } elsif ($action eq "tree") { git_tree(); exit; @@ -141,20 +182,50 @@ if ($action eq "summary") { } elsif ($action eq "blobdiff") { git_blobdiff(); exit; +} elsif ($action eq "blobdiff_plain") { + git_blobdiff_plain(); + exit; } elsif ($action eq "commitdiff") { git_commitdiff(); exit; +} elsif ($action eq "commitdiff_plain") { + git_commitdiff_plain(); + exit; } elsif ($action eq "history") { git_history(); exit; +} elsif ($action eq "search") { + git_search(); + exit; +} elsif ($action eq "shortlog") { + git_shortlog(); + exit; +} elsif ($action eq "tag") { + git_tag(); + exit; } else { undef $action; die_error(undef, "Unknown action."); exit; } +sub esc_url { + my $str = shift; + $str =~ s/\+/%2B/g; + $str =~ s/ /\+/g; + return $str; +} + +sub esc_html { + my $str = shift; + $str = decode("utf8", $str, Encode::FB_DEFAULT); + $str = escapeHTML($str); + return $str; +} + sub git_header_html { my $status = shift || "200 OK"; + my $expires = shift; my $title = "git"; if (defined $project) { @@ -163,13 +234,15 @@ sub git_header_html { $title .= "/$action"; } } - print $cgi->header(-type=>'text/html', -charset => 'utf-8', -status=> $status); + print $cgi->header(-type=>'text/html', -charset => 'utf-8', -status=> $status, -expires => $expires); print < + + $title $rss_link