comparison mercurial/hgweb/hgweb_mod.py @ 26138:f77a3f27cea5

merge with stable

26137:99e8a9ff1f5f

        self.repo = r
        hook.redirect(True)
        self.repostate = ((-1, -1), (-1, -1))
        self.mtime = -1
        self.reponame = name
        # a repo owner may set web.templates in .hg/hgrc to get any file
        # readable by the user running the CGI script
        self.templatepath = self.config('web', 'templates')
        self.websubtable = self.loadwebsub()

    # The CGI scripts are often run by a user different from the repo owner.
    # Trust the settings from the .hg/hgrc files by default.
    def config(self, section, name, default=None, untrusted=True):

26138:f77a3f27cea5

        self.repo = r
        hook.redirect(True)
        self.repostate = ((-1, -1), (-1, -1))
        self.mtime = -1
        self.reponame = name
        # we use untrusted=False to prevent a repo owner from using
        # web.templates in .hg/hgrc to get access to any file readable
        # by the user running the CGI script
        self.templatepath = self.config('web', 'templates', untrusted=False)
        self.websubtable = self.loadwebsub()

    # The CGI scripts are often run by a user different from the repo owner.
    # Trust the settings from the .hg/hgrc files by default.
    def config(self, section, name, default=None, untrusted=True):