summaryrefslogtreecommitdiff
path: root/git-cvsserver.perl
diff options
context:
space:
mode:
authorFrank Lichtenheld <frank@lichtenheld.de>2007-06-07 14:57:00 (GMT)
committerJunio C Hamano <gitster@pobox.com>2007-06-08 09:37:18 (GMT)
commit4890888d742e12044b1f4b89a5d10437a6371253 (patch)
tree5ce676c9858b831e5e52fa4a22be9613e6f525ed /git-cvsserver.perl
parent225696af2ceaa2e06345954003eda742a76c4e0a (diff)
downloadgit-4890888d742e12044b1f4b89a5d10437a6371253.zip
git-4890888d742e12044b1f4b89a5d10437a6371253.tar.gz
git-4890888d742e12044b1f4b89a5d10437a6371253.tar.bz2
cvsserver: Make req_Root more critical of its input data
The path submitted with the Root request has to be absolute (cvs does it this way and it may save us some sanity checks later) If multiple roots are specified (e.g. because we use pserver authentication which will already include the root), ensure that they say all the same. Probably neither is a security risk, and neither should ever be triggered by a sane client, but when validating input data, it's better to be save than sorry. Signed-off-by: Frank Lichtenheld <frank@lichtenheld.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'git-cvsserver.perl')
-rwxr-xr-xgit-cvsserver.perl11
1 files changed, 11 insertions, 0 deletions
diff --git a/git-cvsserver.perl b/git-cvsserver.perl
index 2b4825a..d41b29f 100755
--- a/git-cvsserver.perl
+++ b/git-cvsserver.perl
@@ -167,6 +167,17 @@ sub req_Root
my ( $cmd, $data ) = @_;
$log->debug("req_Root : $data");
+ unless ($data =~ m#^/#) {
+ print "error 1 Root must be an absolute pathname\n";
+ return 0;
+ }
+
+ if ($state->{CVSROOT}
+ && ($state->{CVSROOT} ne $data)) {
+ print "error 1 Conflicting roots specified\n";
+ return 0;
+ }
+
$state->{CVSROOT} = $data;
$ENV{GIT_DIR} = $state->{CVSROOT} . "/";