comparison mercurial/url.py @ 12049:e329c250b0ba stable

url: limit expansion to safe auth keys (Issue2328)

Mads Kiilerich pointed out that 7c9beccb0533 was too eager since the
prefix and password keys may contain $-signs. So this only add the
username to the list of keys that are expanded.

This also updates the documentation to match.

12048:11035185b619

            if '.' not in key:
                self.ui.warn(_("ignoring invalid [auth] key '%s'\n") % key)
                continue
            group, setting = key.split('.', 1)
            gdict = config.setdefault(group, dict())
            val = util.expandpath(val)
            gdict[setting] = val

        # Find the best match
        scheme, hostpath = uri.split('://', 1)
        bestlen = 0

12049:e329c250b0ba

            if '.' not in key:
                self.ui.warn(_("ignoring invalid [auth] key '%s'\n") % key)
                continue
            group, setting = key.split('.', 1)
            gdict = config.setdefault(group, dict())
            if setting in ('username', 'cert', 'key'):
                val = util.expandpath(val)
            gdict[setting] = val

        # Find the best match
        scheme, hostpath = uri.split('://', 1)
        bestlen = 0