mirrors/git
0
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-11-27 20:14:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

gitweb: quote commands properly when calling the shell

Browse Source 
This eliminates the function git_cmd_str, which was used for composing
command lines, and adds a quote_command function, which quotes all of
its arguments (as in quote.c).

Signed-off-by: Lea Wiemann <LeWiemann@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Lea Wiemann 2008-06-17 23:46:35 +02:00 committed by Junio C Hamano
parent 79c6dca413
commit 516381d50b
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
gitweb/gitweb.perl
View File

@ -1500,9 +1500,13 @@ sub git_cmd {
return $GIT, '--git-dir='.$git_dir;
}
# returns path to the core git executable and the --git-dir parameter as string
sub git_cmd_str {
return join(' ', git_cmd());
# quote the given arguments for passing them to the shell
# quote_command("command", "arg 1", "arg with ' and ! characters")
# => "'command' 'arg 1' 'arg with '\'' and '\!' characters'"
# Try to avoid using this function wherever possible.
sub quote_command {
return join(' ',
map( { my $a = $_; $a =~ s/(['!])/'\\$1'/g; "'$a'" } @_ ));
}
# get HEAD ref of given project as hash
@ -4633,7 +4637,6 @@ sub git_snapshot {
$hash = git_get_head_hash($project);
}
my $git_command = git_cmd_str();
my $name = $project;
$name =~ s,([^/])/*\.git$,$1,;
$name = basename($name);
@ -4641,11 +4644,12 @@ sub git_snapshot {
$name =~ s/\047/\047\\\047\047/g;
my $cmd;
$filename .= "-$hash$known_snapshot_formats{$format}{'suffix'}";
$cmd = "$git_command archive " .
"--format=$known_snapshot_formats{$format}{'format'} " .
"--prefix=\'$name\'/ $hash";
$cmd = quote_command(
git_cmd(), 'archive',
"--format=$known_snapshot_formats{$format}{'format'}",
"--prefix=$name/", $hash);
if (exists $known_snapshot_formats{$format}{'compressor'}) {
$cmd .= ' | ' . join ' ', @{$known_snapshot_formats{$format}{'compressor'}};
$cmd .= ' | ' . quote_command(@{$known_snapshot_formats{$format}{'compressor'}});
}
print $cgi->header(
@ -4858,8 +4862,8 @@ sub git_object {
if ($hash || ($hash_base && !defined $file_name)) {
my $object_id = $hash || $hash_base;
my $git_command = git_cmd_str();
open my $fd, "-|", "$git_command cat-file -t $object_id 2>/dev/null"
open my $fd, "-|", quote_command(
git_cmd(), 'cat-file', '-t', $object_id) . ' 2> /dev/null'
or die_error('404 Not Found', "Object does not exist");
$type = <$fd>;
chomp $type;