comparison mercurial/hgweb/protocol.py @ 6335:e29557d687c9

hgweb: only accept POST requests for unbundle

6334:7016f7fb8fe3

    resp = ' '.join(web.capabilities())
    req.respond(HTTP_OK, HGTYPE, length=len(resp))
    req.write(resp)

def unbundle(web, req):
    def bail(response, headers={}):
        length = int(req.env['CONTENT_LENGTH'])
        for s in util.filechunkiter(req, limit=length):
            # drain incoming bundle, else client will not see
            # response when run outside cgi script
            pass
        req.header(headers.items())
        req.respond(HTTP_OK, HGTYPE)
        req.write('0\n')
        req.write(response)

    # require ssl by default, auth info cannot be sniffed and
    # replayed
    ssl_req = web.configbool('web', 'push_ssl', True)
    if ssl_req:

    else:
        proto = 'http'

    # do not allow push unless explicitly allowed
    if not web.check_perm(req, 'push', False):
        bail('push not authorized\n',
             headers={'status': '401 Unauthorized'})
        return

    their_heads = req.form['heads'][0].split(' ')

    def check_heads():

6335:e29557d687c9

    resp = ' '.join(web.capabilities())
    req.respond(HTTP_OK, HGTYPE, length=len(resp))
    req.write(resp)

def unbundle(web, req):

    def bail(response, headers={}):
        length = int(req.env.get('CONTENT_LENGTH', 0))
        for s in util.filechunkiter(req, limit=length):
            # drain incoming bundle, else client will not see
            # response when run outside cgi script
            pass

        status = headers.pop('status', HTTP_OK)
        req.header(headers.items())
        req.respond(status, HGTYPE)
        req.write('0\n')
        req.write(response)

    # enforce that you can only unbundle with POST requests
    if req.env['REQUEST_METHOD'] != 'POST':
        headers = {'status': '405 Method Not Allowed'}
        bail('unbundle requires POST request\n', headers)
        return

    # require ssl by default, auth info cannot be sniffed and
    # replayed
    ssl_req = web.configbool('web', 'push_ssl', True)
    if ssl_req:

    else:
        proto = 'http'

    # do not allow push unless explicitly allowed
    if not web.check_perm(req, 'push', False):
        bail('push not authorized\n', headers={'status': '401 Unauthorized'})
        return

    their_heads = req.form['heads'][0].split(' ')

    def check_heads():