comparison mercurial/help/config.txt @ 15004:d06b9c55ddab stable

hgweb: raw file mimetype guessing configurable, off by default (BC) (issue2923)

Before: hgweb made it possible to download file content with a content type
detected from the file extension. It would serve .html files as text/html and
could thus cause XSS vulnerabilities if the web site had any kind of session
authorization and the repository content wasn't fully trusted.

Now: all files default to "application/binary", which all important
browsers will refuse to treat as text/html. See the table here:

https://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors

15001:dd74cd1e5d49

    push, including unauthenticated users. Otherwise, the remote user
    must have been authenticated, and the authenticated user name must
    be present in this list. The contents of the allow_push list are
    examined after the deny_push list.

``allow_read``
    If the user has not already been denied repository access due to
    the contents of deny_read, this list determines whether to grant
    repository access to the user. If this list is not empty, and the
    user is unauthenticated or not present in the list, then access is

15004:d06b9c55ddab

    push, including unauthenticated users. Otherwise, the remote user
    must have been authenticated, and the authenticated user name must
    be present in this list. The contents of the allow_push list are
    examined after the deny_push list.

``guessmime``
    Control MIME types for raw download of file content.
    Set to True to let hgweb guess the content type from the file
    extension. This will serve HTML files as ``text/html`` and might
    allow cross-site scripting attacks when serving untrusted
    repositories. Default is False.
   
``allow_read``
    If the user has not already been denied repository access due to
    the contents of deny_read, this list determines whether to grant
    repository access to the user. If this list is not empty, and the
    user is unauthenticated or not present in the list, then access is