Skip to content

Commit dfff4b7

Browse files
committed
gitweb: do not run "git diff" that is Porcelain
Jakub says that legacy-style URI to view two blob differences are never generated since 1.4.3. This codepath runs "git diff" Porcelain from the gitweb, which is a no-no. It can trigger diff.external command that is specified in the configuration file of the repository being viewed. This patch applies to v1.5.4 and later. Signed-off-by: Junio C Hamano <[email protected]>
1 parent 872354d commit dfff4b7

File tree

1 file changed

+2
-36
lines changed

1 file changed

+2
-36
lines changed

gitweb/gitweb.perl

Lines changed: 2 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -4809,43 +4809,9 @@ sub git_blobdiff {
48094809
or die_error(undef, "Open git-diff-tree failed");
48104810
}
48114811

4812-
# old/legacy style URI
4813-
if (!%diffinfo && # if new style URI failed
4814-
defined $hash && defined $hash_parent) {
4815-
# fake git-diff-tree raw output
4816-
$diffinfo{'from_mode'} = $diffinfo{'to_mode'} = "blob";
4817-
$diffinfo{'from_id'} = $hash_parent;
4818-
$diffinfo{'to_id'} = $hash;
4819-
if (defined $file_name) {
4820-
if (defined $file_parent) {
4821-
$diffinfo{'status'} = '2';
4822-
$diffinfo{'from_file'} = $file_parent;
4823-
$diffinfo{'to_file'} = $file_name;
4824-
} else { # assume not renamed
4825-
$diffinfo{'status'} = '1';
4826-
$diffinfo{'from_file'} = $file_name;
4827-
$diffinfo{'to_file'} = $file_name;
4828-
}
4829-
} else { # no filename given
4830-
$diffinfo{'status'} = '2';
4831-
$diffinfo{'from_file'} = $hash_parent;
4832-
$diffinfo{'to_file'} = $hash;
4833-
}
4834-
4835-
# non-textual hash id's can be cached
4836-
if ($hash =~ m/^[0-9a-fA-F]{40}$/ &&
4837-
$hash_parent =~ m/^[0-9a-fA-F]{40}$/) {
4838-
$expires = '+1d';
4839-
}
4840-
4841-
# open patch output
4842-
open $fd, "-|", git_cmd(), "diff", @diff_opts,
4843-
'-p', ($format eq 'html' ? "--full-index" : ()),
4844-
$hash_parent, $hash, "--"
4845-
or die_error(undef, "Open git-diff failed");
4846-
} else {
4812+
# old/legacy style URI -- not generated anymore since 1.4.3.
4813+
if (!%diffinfo) {
48474814
die_error('404 Not Found', "Missing one of the blob diff parameters")
4848-
unless %diffinfo;
48494815
}
48504816

48514817
# header

0 commit comments

Comments
 (0)