X-Git-Url: https://gitweb.ps.run/ps-cgit/blobdiff_plain/6e498de213aeebf63523ff0f298c2ae6393f9c0f..2fc008d6dea2456548825c973a5516b5cdfd9c8c:/ui-clone.c?ds=sidebyside

diff --git a/ui-clone.c b/ui-clone.c
index e35d3d3..6ba8f36 100644
--- a/ui-clone.c
+++ b/ui-clone.c
@@ -11,20 +11,22 @@
 #include "ui-clone.h"
 #include "html.h"
 #include "ui-shared.h"
+#include "packfile.h"
+#include "object-store.h"
 
-static int print_ref_info(const char *refname, const unsigned char *sha1,
+static int print_ref_info(const char *refname, const struct object_id *oid,
                           int flags, void *cb_data)
 {
 	struct object *obj;
 
-	if (!(obj = parse_object(sha1)))
+	if (!(obj = parse_object(oid)))
 		return 0;
 
-	htmlf("%s\t%s\n", sha1_to_hex(sha1), refname);
+	htmlf("%s\t%s\n", oid_to_hex(oid), refname);
 	if (obj->type == OBJ_TAG) {
 		if (!(obj = deref_tag(obj, refname, 0)))
 			return 0;
-		htmlf("%s\t%s^{}\n", sha1_to_hex(obj->sha1), refname);
+		htmlf("%s\t%s^{}\n", oid_to_hex(&obj->oid), refname);
 	}
 	return 0;
 }
@@ -37,8 +39,8 @@ static void print_pack_info(void)
 	ctx.page.mimetype = "text/plain";
 	ctx.page.filename = "objects/info/packs";
 	cgit_print_http_headers();
-	prepare_packed_git();
-	for (pack = packed_git; pack; pack = pack->next) {
+	reprepare_packed_git(the_repository);
+	for (pack = get_packed_git(the_repository); pack; pack = pack->next) {
 		if (pack->pack_local) {
 			offset = strrchr(pack->pack_name, '/');
 			if (offset && offset[1] != '\0')
@@ -50,20 +52,20 @@ static void print_pack_info(void)
 	}
 }
 
-static void send_file(char *path)
+static void send_file(const char *path)
 {
 	struct stat st;
 
 	if (stat(path, &st)) {
 		switch (errno) {
 		case ENOENT:
-			html_status(404, "Not found", 0);
+			cgit_print_error_page(404, "Not found", "Not found");
 			break;
 		case EACCES:
-			html_status(403, "Forbidden", 0);
+			cgit_print_error_page(403, "Forbidden", "Forbidden");
 			break;
 		default:
-			html_status(400, "Bad request", 0);
+			cgit_print_error_page(400, "Bad request", "Bad request");
 		}
 		return;
 	}
@@ -78,7 +80,7 @@ static void send_file(char *path)
 void cgit_clone_info(void)
 {
 	if (!ctx.qry.path || strcmp(ctx.qry.path, "refs")) {
-		html_status(400, "Bad request", 0);
+		cgit_print_error_page(400, "Bad request", "Bad request");
 		return;
 	}
 
@@ -90,17 +92,32 @@ void cgit_clone_info(void)
 
 void cgit_clone_objects(void)
 {
-	if (!ctx.qry.path) {
-		html_status(400, "Bad request", 0);
-		return;
-	}
+	char *p;
+
+	if (!ctx.qry.path)
+		goto err;
 
 	if (!strcmp(ctx.qry.path, "info/packs")) {
 		print_pack_info();
 		return;
 	}
 
+	/* Avoid directory traversal by forbidding "..", but also work around
+	 * other funny business by just specifying a fairly strict format. For
+	 * example, now we don't have to stress out about the Cygwin port.
+	 */
+	for (p = ctx.qry.path; *p; ++p) {
+		if (*p == '.' && *(p + 1) == '.')
+			goto err;
+		if (!isalnum(*p) && *p != '/' && *p != '.' && *p != '-')
+			goto err;
+	}
+
 	send_file(git_path("objects/%s", ctx.qry.path));
+	return;
+
+err:
+	cgit_print_error_page(400, "Bad request", "Bad request");
 }
 
 void cgit_clone_head(void)