hgweb: prevent triggering dummy href="#" handler
Follow up for the previous patch.
paper: add href="#" to links with click handlers
This restores the styling that was accidentally removed by the
previous change to these files.
Differential Revision: https://phab.mercurial-scm.org/D3438
paper: don't register click handlers with inline javascript (
issue5812)
The use of inline href="javascript:" undermines CSP policies that
don't allow inline javascript.
This commit changes the registering of the diffstat and line wrapping
toggle handlers to the the global DOMContentLoaded handler, thus
eliminating all inline javascript from the paper template.
Differential Revision: https://phab.mercurial-scm.org/D3437
hgweb: allow Content-Security-Policy header on 304 responses (
issue5844)
A side-effect of
98baf8dea553 was that the Content-Security-Policy
header was set on all HTTP responses by default. This header wasn't
in our list of allowed headers for HTTP 304 responses. This would
trigger a ProgrammingError when a 304 response was issued via hgwebdir.
This commit adds Content-Security-Policy to the allow list of headers
for 304 responses so we no longer encounter the error.
Differential Revision: https://phab.mercurial-scm.org/D3436
hgweb: discard Content-Type header for 304 responses (
issue5844)
A side-effect of
98baf8dea553 was that hgwebdir always sets a global
default for the Content-Type header. HTTP 304 responses don't allow
the Content-Type header. So a side-effect of this change was that
HTTP 304 responses served via hgwebdir resulted in a ProgrammingError
being raised.
This commit teaches our 304 response issuing code to drop the
Content-Type header.
Differential Revision: https://phab.mercurial-scm.org/D3435
tests: add tests demonstrating ISE for HTTP 304 responses with hgwebdir
There are two separate failures here. One for the Content-Type header.
Another for the Content-Security-Policy header.
Differential Revision: https://phab.mercurial-scm.org/D3434
hgweb: guard against empty Content-Length header
Discussion in issue 5860 seems to indicate this can occur.
Differential Revision: https://phab.mercurial-scm.org/D3432