Mercurial > hg-stable

changeset 26163:84511b1d9724

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
hgweb: move templatepath to requestcontext This does change behavior in that the templatepath could change during the lifetime of the server. But everything else can change, I don't see why template paths can't.
author Gregory Szorc <gregory.szorc@gmail.com>
date Sat, 22 Aug 2015 16:28:22 -0700
parents 268b39770c28
children e037fd28c8bb
files mercurial/hgweb/hgweb_mod.py
diffstat 1 files changed, 6 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/mercurial/hgweb/hgweb_mod.py	Sat Aug 22 15:40:33 2015 -0700
+++ b/mercurial/hgweb/hgweb_mod.py	Sat Aug 22 16:28:22 2015 -0700
@@ -84,6 +84,12 @@
         object.__setattr__(self, 'allowpull',
                            self.configbool('web', 'allowpull', True))
 
+        # we use untrusted=False to prevent a repo owner from using
+        # web.templates in .hg/hgrc to get access to any file readable
+        # by the user running the CGI script
+        object.__setattr__(self, 'templatepath',
+                           self.config('web', 'templates', untrusted=False))
+
     # Proxy unknown reads and writes to the application instance
     # until everything is moved to us.
     def __getattr__(self, name):
@@ -158,10 +164,6 @@
         self.repostate = None
         self.mtime = -1
         self.reponame = name
-        # we use untrusted=False to prevent a repo owner from using
-        # web.templates in .hg/hgrc to get access to any file readable
-        # by the user running the CGI script
-        self.templatepath = self.config('web', 'templates', untrusted=False)
         self.websubtable = webutil.getwebsubs(r)
 
     # The CGI scripts are often run by a user different from the repo owner.