Sun, 26 Aug 2018 22:18:09 +0900 hgweb: do not audit URL path as working-directory path
Yuya Nishihara <yuya@tcha.org> [Sun, 26 Aug 2018 22:18:09 +0900] rev 39488
hgweb: do not audit URL path as working-directory path Since hgweb is an interface to repository data, we don't need to prohibit any paths conflicting within the filesystem. Still an access to working files is audited by filectx.
Sun, 26 Aug 2018 22:23:25 +0900 hgweb: map Abort to 403 error to report inaccessible path for example
Yuya Nishihara <yuya@tcha.org> [Sun, 26 Aug 2018 22:23:25 +0900] rev 39487
hgweb: map Abort to 403 error to report inaccessible path for example Abort is so common in our codebase. We could instead introduce a dedicated type for path auditing errors, but we'll probably have to catch error.Abort anyway. As you can see, an abort message may include a full path to the repository, which might be considered information leak. If that matters, we should hide the message and send it to the server log instead.
Fri, 07 Sep 2018 22:19:28 +0900 hgweb: add error template to json so it won't crash
Yuya Nishihara <yuya@tcha.org> [Fri, 07 Sep 2018 22:19:28 +0900] rev 39486
hgweb: add error template to json so it won't crash
(0) -30000 -10000 -3000 -1000 -300 -100 -30 -10 -3 +3 +10 +30 +100 +300 +1000 +3000 +10000 tip