about summary refs log tree commit diff
path: root/.gitmodules
diff options
context:
space:
mode:
authorJason A. Donenfeld <Jason@zx2c4.com>2018-08-03 15:46:11 +0200
committerJason A. Donenfeld <Jason@zx2c4.com>2018-08-03 17:04:03 +0200
commit53efaf30b50f095cad8c160488c74bba3e3b2680 (patch)
tree48c0be88bfef03400ddd4b3871baf9de9dbe0b77 /.gitmodules
parentconfig: record repo.snapshot-prefix in the per-repo config (diff)
downloadcgit-pink-53efaf30b50f095cad8c160488c74bba3e3b2680.tar.gz
cgit-pink-53efaf30b50f095cad8c160488c74bba3e3b2680.zip
clone: fix directory traversal
This was introduced in the initial version of this code, way back when
in 2008.

$ curl http://127.0.0.1/cgit/repo/objects/?path=../../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/sh
...

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reported-by: Jann Horn <jannh@google.com>
Diffstat (limited to '.gitmodules')
0 files changed, 0 insertions, 0 deletions
n shottyJune McEnroe This is how curses puts characters into the bottom-right cell of the terminal. 2019-07-11Don't do carriage return on line feedJune McEnroe 2019-07-11Interpret 256color-style SGRsJune McEnroe 2019-07-11Use inline style rather than <b>, <i>, <u>June McEnroe 2019-07-11Factor out clearJune McEnroe 2019-07-11Add bright option to shottyJune McEnroe 2019-07-11Output <b>, <i>, <u> in shottyJune McEnroe 2019-07-10Ignore SM and RMJune McEnroe 2019-07-09Add shotty man page and build itJune McEnroe 2019-07-09Add up -cJune McEnroe 2019-07-09Add options for default colors to shottyJune McEnroe 2019-07-08Use char literals consistentlyJune McEnroe