revert: introduce short option -C for --no-backup
Corresponds to -C of the update command.
It's much more convenient to use:
$ hg revert -aC
than having to type
$ hg revert -a --no-backup
I think the 'no-backup' case is a frequent use case.
Introducing short option -C here fits with the muscle memory we have from
'hg update -C', which is described there as "discard uncommitted changes
(no backup)".
Added signature for changeset
4a43e23b8c55
Added tag 1.9.1 for changeset
4a43e23b8c55
hgweb: do not ignore [auth] if url has a username (
issue2822)
The [auth] section was ignored when handling URLs like:
http://user@example.com/foo
Instead, we look in [auth] for an entry matching the URL and supplied user
name. Entries without username can match URL with a username. Prefix length
ties are resolved in favor of entries matching the username. With:
foo.prefix = http://example.org
foo.username = user
foo.password = password
bar.prefix = http://example.org/bar
and the input URL:
http://user@example.org/bar
the 'bar' entry will be selected because of prefix length, therefore prompting
for a password. This behaviour ensure that entries selection is consistent when
looking for credentials or for certificates, and that certificates can be
picked even if their entries do no define usernames while the URL does.
Additionally, entries without a username matched against a username are
returned as if they did have requested username set to avoid prompting again
for a username if the password is not set.
v2: reparse the URL in readauthforuri() to handle HTTP and HTTPS similarly.
v3: allow unset usernames to match URL usernames to pick certificates. Resolve
prefix length ties in favor of entries with usernames.
hgweb: raw file mimetype guessing configurable, off by default (BC) (
issue2923)
Before: hgweb made it possible to download file content with a content type
detected from the file extension. It would serve .html files as text/html and
could thus cause XSS vulnerabilities if the web site had any kind of session
authorization and the repository content wasn't fully trusted.
Now: all files default to "application/binary", which all important
browsers will refuse to treat as text/html. See the table here:
https://code.google.com/p/browsersec/wiki/Part2#Survey_of_content_sniffing_behaviors