Compare commits

..

7 Commits

Author SHA1 Message Date
b91779f17e Git 1.7.2.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:45:36 -08:00
9db41eba42 Git 1.7.1.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:40:40 -08:00
cb198b3b67 Git 1.7.0.9
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:38:19 -08:00
abf411e28d Git 1.6.6.3
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:32:57 -08:00
ec82874ad4 Git 1.6.5.9
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:27:41 -08:00
88fcc52e44 Git 1.6.4.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:19:11 -08:00
3017ed62f4 gitweb: Introduce esc_attr to escape attributes of HTML elements
It is needed only to escape attributes of handcrafted HTML elements,
and not those generated using CGI.pm subroutines / methods for HTML
generation.

While at it, add esc_url and esc_html where needed, and prefer to use
CGI.pm HTML generating methods than handcrafted HTML code.  Most of
those are probably unnecessary (could be exploited only by person with
write access to gitweb config, or at least access to the repository).

This fixes CVE-2010-3906

Reported-by: Emanuele Gentili <e.gentili@tigersecurity.it>
Helped-by: John 'Warthog9' Hawley <warthog9@kernel.org>
Helped-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2010-12-15 11:16:31 -08:00
566 changed files with 9797 additions and 24229 deletions

11
.gitignore vendored
View File

@ -166,17 +166,12 @@
/test-dump-cache-tree
/test-genrandom
/test-index-version
/test-line-buffer
/test-match-trees
/test-obj-pool
/test-parse-options
/test-path-utils
/test-run-command
/test-sha1
/test-sigchain
/test-string-pool
/test-svn-fe
/test-treap
/common-cmds.h
*.tar.gz
*.dsc
@ -186,12 +181,6 @@
*.[aos]
*.py[co]
.depend/
*.gcda
*.gcno
*.gcov
/coverage-untested-functions
/cover_db/
/cover_db_html/
*+
/config.mak
/autom4te.cache

View File

@ -31,36 +31,25 @@ But if you must have a list of rules, here they are.
For shell scripts specifically (not exhaustive):
- We use tabs for indentation.
- Case arms are indented at the same depth as case and esac lines.
- We prefer $( ... ) for command substitution; unlike ``, it
properly nests. It should have been the way Bourne spelled
it from day one, but unfortunately isn't.
- We use POSIX compliant parameter substitutions and avoid bashisms;
namely:
- We use ${parameter-word} and its [-=?+] siblings, and their
colon'ed "unset or null" form.
- We use ${parameter-word} and its [-=?+] siblings, and their
colon'ed "unset or null" form.
- We use ${parameter#word} and its [#%] siblings, and their
doubled "longest matching" form.
- No "Substring Expansion" ${parameter:offset:length}.
- No shell arrays.
- No strlen ${#parameter}.
- No pattern replacement ${parameter/pattern/string}.
- We use ${parameter#word} and its [#%] siblings, and their
doubled "longest matching" form.
- We use Arithmetic Expansion $(( ... )).
- Inside Arithmetic Expansion, spell shell variables with $ in front
of them, as some shells do not grok $((x)) while accepting $(($x))
just fine (e.g. dash older than 0.5.4).
- No "Substring Expansion" ${parameter:offset:length}.
- No shell arrays.
- No strlen ${#parameter}.
- No regexp ${parameter/pattern/string}.
- We do not use Process Substitution <(list) or >(list).

View File

@ -279,7 +279,7 @@ $(patsubst %,%.html,$(API_DOCS) technical/api-index): %.html : %.txt
XSLT = docbook.xsl
XSLTOPTS = --xinclude --stringparam html.stylesheet docbook-xsl.css
user-manual.html: user-manual.xml $(XSLT)
user-manual.html: user-manual.xml
$(QUIET_XSLTPROC)$(RM) $@+ $@ && \
xsltproc $(XSLTOPTS) -o $@+ $(XSLT) $< && \
mv $@+ $@

Some files were not shown because too many files have changed in this diff Show More