Compare commits

..

4 Commits

Author SHA1 Message Date
abf411e28d Git 1.6.6.3
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:32:57 -08:00
ec82874ad4 Git 1.6.5.9
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:27:41 -08:00
88fcc52e44 Git 1.6.4.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:19:11 -08:00
3017ed62f4 gitweb: Introduce esc_attr to escape attributes of HTML elements
It is needed only to escape attributes of handcrafted HTML elements,
and not those generated using CGI.pm subroutines / methods for HTML
generation.

While at it, add esc_url and esc_html where needed, and prefer to use
CGI.pm HTML generating methods than handcrafted HTML code.  Most of
those are probably unnecessary (could be exploited only by person with
write access to gitweb config, or at least access to the repository).

This fixes CVE-2010-3906

Reported-by: Emanuele Gentili <e.gentili@tigersecurity.it>
Helped-by: John 'Warthog9' Hawley <warthog9@kernel.org>
Helped-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:16:31 -08:00
1062 changed files with 22276 additions and 73687 deletions

1
.gitattributes vendored
View File

@ -1,3 +1,2 @@
* whitespace=!indent,trail,space
*.[ch] whitespace=indent,trail,space
*.sh whitespace=indent,trail,space

22
.gitignore vendored
View File

@ -2,7 +2,6 @@
/GIT-CFLAGS
/GIT-GUI-VARS
/GIT-VERSION-FILE
/bin-wrappers/
/git
/git-add
/git-add--interactive
@ -108,11 +107,6 @@
/git-relink
/git-remote
/git-remote-curl
/git-remote-http
/git-remote-https
/git-remote-ftp
/git-remote-ftps
/git-remote-testgit
/git-repack
/git-replace
/git-repo-config
@ -156,27 +150,18 @@
/git-write-tree
/git-core-*/?*
/gitk-git/gitk-wish
/gitweb/GITWEB-BUILD-OPTIONS
/gitweb/gitweb.cgi
/gitweb/static/gitweb.min.*
/test-chmtime
/test-ctype
/test-date
/test-delta
/test-dump-cache-tree
/test-genrandom
/test-index-version
/test-line-buffer
/test-match-trees
/test-obj-pool
/test-parse-options
/test-path-utils
/test-run-command
/test-sha1
/test-sigchain
/test-string-pool
/test-svn-fe
/test-treap
/common-cmds.h
*.tar.gz
*.dsc
@ -185,13 +170,6 @@
*.exe
*.[aos]
*.py[co]
.depend/
*.gcda
*.gcno
*.gcov
/coverage-untested-functions
/cover_db/
/cover_db_html/
*+
/config.mak
/autom4te.cache

View File

@ -5,7 +5,6 @@
# same person appearing not to be so.
#
Alex Bennée <kernel-hacker@bennee.com>
Alexander Gavrilov <angavrilov@gmail.com>
Aneesh Kumar K.V <aneesh.kumar@gmail.com>
Brian M. Carlson <sandals@crustytoothpaste.ath.cx>
@ -16,7 +15,6 @@ Daniel Barkalow <barkalow@iabervon.org>
David D. Kilzer <ddkilzer@kilzer.net>
David Kågedal <davidk@lysator.liu.se>
David S. Miller <davem@davemloft.net>
Deskin Miller <deskinm@umich.edu>
Dirk Süsserott <newsletter@dirk.my1.cc>
Fredrik Kuivinen <freku045@student.liu.se>
H. Peter Anvin <hpa@bonde.sc.orionmulti.com>
@ -38,7 +36,6 @@ Li Hong <leehong@pku.edu.cn>
Lukas Sandström <lukass@etek.chalmers.se>
Martin Langhoff <martin@catalyst.net.nz>
Michael Coleman <tutufan@gmail.com>
Michael J Gruber <git@drmicha.warpmail.net> <michaeljgruber+gmane@fastmail.fm>
Michael W. Olson <mwolson@gnu.org>
Michele Ballabio <barra_cuda@katamail.com>
Nanako Shiraishi <nanako3@bluebottle.com>
@ -62,7 +59,6 @@ Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
Uwe Kleine-König <uzeisberger@io.fsforth.de>
Uwe Kleine-König <zeisberg@informatik.uni-freiburg.de>
Ville Skyttä <scop@xemacs.org>
Vitaly "_Vi" Shukela <public_vi@tut.by>
William Pursell <bill.pursell@gmail.com>
YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
anonymous <linux@horizon.com>

25
COPYING
View File

@ -22,8 +22,8 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
@ -36,7 +36,7 @@ software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Lesser General Public License instead.) You can apply it to
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
@ -76,7 +76,7 @@ patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
@ -131,7 +131,7 @@ above, provided that you also meet all of these conditions:
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
@ -189,7 +189,7 @@ access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
@ -246,7 +246,7 @@ impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
@ -299,7 +299,7 @@ PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
@ -324,9 +324,10 @@ the "copyright" line and a pointer to where the full notice is found.
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Also add information on how to contact you by electronic and paper mail.
@ -356,5 +357,5 @@ necessary. Here is a sample; alter the names:
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Lesser General
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.

View File

@ -31,36 +31,25 @@ But if you must have a list of rules, here they are.
For shell scripts specifically (not exhaustive):
- We use tabs for indentation.
- Case arms are indented at the same depth as case and esac lines.
- We prefer $( ... ) for command substitution; unlike ``, it
properly nests. It should have been the way Bourne spelled
it from day one, but unfortunately isn't.
- We use POSIX compliant parameter substitutions and avoid bashisms;
namely:
- We use ${parameter-word} and its [-=?+] siblings, and their
colon'ed "unset or null" form.
- We use ${parameter-word} and its [-=?+] siblings, and their
colon'ed "unset or null" form.
- We use ${parameter#word} and its [#%] siblings, and their
doubled "longest matching" form.
- No "Substring Expansion" ${parameter:offset:length}.
- No shell arrays.
- No strlen ${#parameter}.
- No pattern replacement ${parameter/pattern/string}.
- We use ${parameter#word} and its [#%] siblings, and their
doubled "longest matching" form.
- We use Arithmetic Expansion $(( ... )).
- Inside Arithmetic Expansion, spell shell variables with $ in front
of them, as some shells do not grok $((x)) while accepting $(($x))
just fine (e.g. dash older than 0.5.4).
- No "Substring Expansion" ${parameter:offset:length}.
- No shell arrays.
- No strlen ${#parameter}.
- No regexp ${parameter/pattern/string}.
- We do not use Process Substitution <(list) or >(list).

View File

@ -6,7 +6,7 @@ MAN5_TXT=gitattributes.txt gitignore.txt gitmodules.txt githooks.txt \
gitrepository-layout.txt
MAN7_TXT=gitcli.txt gittutorial.txt gittutorial-2.txt \
gitcvs-migration.txt gitcore-tutorial.txt gitglossary.txt \
gitdiffcore.txt gitrevisions.txt gitworkflows.txt
gitdiffcore.txt gitworkflows.txt
MAN_TXT = $(MAN1_TXT) $(MAN5_TXT) $(MAN7_TXT)
MAN_XML=$(patsubst %.txt,%.xml,$(MAN_TXT))
@ -204,7 +204,7 @@ install-pdf: pdf
install-html: html
'$(SHELL_PATH_SQ)' ./install-webdoc.sh $(DESTDIR)$(htmldir)
../GIT-VERSION-FILE: FORCE
../GIT-VERSION-FILE: .FORCE-GIT-VERSION-FILE
$(QUIET_SUBDIR0)../ $(QUIET_SUBDIR1) GIT-VERSION-FILE
-include ../GIT-VERSION-FILE
@ -264,9 +264,7 @@ manpage-base-url.xsl: manpage-base-url.xsl.in
mv $@+ $@
user-manual.xml: user-manual.txt user-manual.conf
$(QUIET_ASCIIDOC)$(RM) $@+ $@ && \
$(ASCIIDOC) $(ASCIIDOC_EXTRA) -b docbook -d book -o $@+ $< && \
mv $@+ $@
$(QUIET_ASCIIDOC)$(ASCIIDOC) $(ASCIIDOC_EXTRA) -b docbook -d book $<
technical/api-index.txt: technical/api-index-skel.txt \
technical/api-index.sh $(patsubst %,%.txt,$(API_DOCS))
@ -279,10 +277,8 @@ $(patsubst %,%.html,$(API_DOCS) technical/api-index): %.html : %.txt
XSLT = docbook.xsl
XSLTOPTS = --xinclude --stringparam html.stylesheet docbook-xsl.css
user-manual.html: user-manual.xml $(XSLT)
$(QUIET_XSLTPROC)$(RM) $@+ $@ && \
xsltproc $(XSLTOPTS) -o $@+ $(XSLT) $< && \
mv $@+ $@
user-manual.html: user-manual.xml
$(QUIET_XSLTPROC)xsltproc $(XSLTOPTS) -o $@ $(XSLT) $<
git.info: user-manual.texi
$(QUIET_MAKEINFO)$(MAKEINFO) --no-split -o $@ user-manual.texi
@ -341,4 +337,4 @@ quick-install-man:
quick-install-html:
'$(SHELL_PATH_SQ)' ./install-doc-quick.sh $(HTML_REF) $(DESTDIR)$(htmldir)
.PHONY: FORCE
.PHONY: .FORCE-GIT-VERSION-FILE

View File

@ -4,7 +4,7 @@ GIT v1.5.6.3 Release Notes
Fixes since v1.5.6.2
--------------------
* Setting core.sharedrepository to traditional "true" value was supposed to make
* Setting core.sharerepository to traditional "true" value was supposed to make
the repository group writable but should not affect permission for others.
However, since 1.5.6, it was broken to drop permission for others when umask is
022, making the repository unreadable by others.

View File

@ -17,7 +17,7 @@ Fixes since v1.6.0.1
* Many commands did not use the correct working tree location when used
with GIT_WORK_TREE environment settings.
* Some systems need to use compatibility fnmatch and regex libraries
* Some systems needs to use compatibility fnmach and regex libraries
independent from each other; the compat/ area has been reorganized to
allow this.

View File

@ -11,7 +11,7 @@ Fixes since v1.6.4.2
been deprecated.
* "git fetch" and "git clone" had an extra sanity check to verify the
presence of the corresponding *.pack file before downloading *.idx
presense of the corresponding *.pack file before downloading *.idx
file by issuing a HEAD request. Github server however sometimes
gave 500 (Internal server error) response to HEAD even if a GET
request for *.pack file to the same URL would have succeeded, and broke

View File

@ -26,7 +26,7 @@ Fixes since v1.6.5.3
future versions, but not in this release,
* "git merge -m <message> <branch>..." added the standard merge message
on its own after user-supplied message, which should have overridden the
on its own after user-supplied message, which should have overrided the
standard one.
Other minor documentation updates are included.

View File

@ -10,7 +10,7 @@ Fixes since v1.6.5.6
an older version of git should just ignore them. Instead we diagnosed
it as an error.
* With help.autocorrect set to non-zero value, the logic to guess typos
* With help.autocorrect set to non-zero value, the logic to guess typoes
in the subcommand name misfired and ran a random nonsense command.
* If a command is run with an absolute path as a pathspec inside a bare

View File

@ -29,7 +29,7 @@ or adjust to the new behaviour, on the day their sysadmin decides to install
the new version of git. When we switched from "git-foo" to "git foo" in
1.6.0, even though the change had been advertised and the transition
guide had been provided for a very long time, the users procrastinated
during the entire transition period, and ended up panicking on the day
during the entire transtion period, and ended up panicking on the day
their sysadmins updated their git installation. We are trying to avoid
repeating that unpleasantness in the 1.7.0 release.
@ -94,7 +94,7 @@ users will fare this time.
* "git diff" traditionally treated various "ignore whitespace" options
only as a way to filter the patch output. "git diff --exit-code -b"
exited with non-zero status even if all changes were about changing the
amount of whitespace and nothing else. and "git diff -b" showed the
ammount of whitespace and nothing else. and "git diff -b" showed the
"diff --git" header line for such a change without patch text.
In 1.7.0, the "ignore whitespaces" will affect the semantics of the

View File

@ -0,0 +1,20 @@
Git v1.6.4.5 Release Notes
==========================
Fixes since v1.6.4.4
--------------------
* Simplified base85 implementation.
* An overlong line after ".gitdir: " in a git file caused out of bounds
access to an array on the stack.
* "git count-objects" did not handle packs larger than 4G.
* "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
when --keep-dashdash was in effect.
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.
Other minor fixes and documentation updates are included.

View File

@ -0,0 +1,18 @@
Git v1.6.5.9 Release Notes
==========================
Fixes since v1.6.5.8
--------------------
* An overlong line after ".gitdir: " in a git file caused out of bounds
access to an array on the stack.
* "git blame -L $start,$end" segfaulted when too large $start was given.
* "git rev-parse --parseopt --stop-at-non-option" did not stop at non option
when --keep-dashdash was in effect.
* "gitweb" can sometimes be tricked into parrotting a filename argument
given in a request without properly quoting.
Other minor fixes and documentation updates are included.

Some files were not shown because too many files have changed in this diff Show More