hgweb: raw file mimetype guessing configurable, off by default (BC) (issue2923)
Before: hgweb made it possible to download file content with a content type
detected from the file extension. It would serve .html files as text/html and
could thus cause XSS vulnerabilities if the web site had any kind of session
authorization and the repository content wasn't fully trusted.
Now: all files default to "application/binary", which all important
browsers will refuse to treat as text/html. See the table here:
https://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors
#
# tcsh completion for Mercurial
#
# This file has been auto-generated by tcsh_completion_build.sh for
# Mercurial Distributed SCM (version 1.7.5+157-8a220ae0b2ba)
#
# Copyright (C) 2005 TK Soh.
#
# This is free software; you can redistribute it and/or modify it under
# the terms of the GNU General Public License as published by the Free
# Software Foundation; either version 2 of the License, or (at your
# option) any later version.
#
complete hg \
'n/--cwd/d/' 'n/-R/d/' 'n/--repository/d/' \
'C/-/( -R --repository \
--cwd \
-y --noninteractive \
-q --quiet \
-v --verbose \
--config \
--debug \
--debugger \
--encoding \
--encodingmode \
--traceback \
--time \
--profile \
--version \
-h --help)/' \
'p/1/(add addremove annotate blame archive \
backout bisect bookmarks branch branches \
bundle cat clone commit ci \
copy cp debugancestor debugbuilddag debugcheckstate \
debugcommands debugcomplete debugdag debugdata debugdate \
debugfsinfo debugignore debugindex debugindexdot debuginstall \
debugpushkey debugrebuildstate debugrename debugrevspec debugsetparents \
debugstate debugsub debugwalk diff export \
forget grep heads help identify \
id import patch incoming in \
init locate log history manifest \
merge outgoing out parents paths \
pull push recover remove rm \
rename move mv resolve revert \
rollback root serve showconfig debugconfig \
status st summary sum tag \
tags tip unbundle update up \
checkout co verify version)/'