kallithea Files · docs/theme/nature/layout.html

Files @ a444c46a0649

Branch filter:

Location: kallithea/docs/theme/nature/layout.html - annotation

a444c46a0649 1.0 KiB text/html Show Source Show as Raw Download as Raw

Mads Kiilerich

middleware: fix handling of Git 'info/refs' command to give correct access control

For a pull, the Git client first sends an 'info/refs' command with a
'service=git-upload-pack' query, then it sends the actual 'git-upload-pack'
command.

For a push, the Git client first sends an 'info/refs' command with a
'service=git-receive-pack' query, then it sends the actual 'git-receive-pack'
command.

Before, the 'info/refs' commands would fall back to the default of trying to
use the action of the previous request. That seems wrong.

Instead, authorize the 'info/refs' command just like the actual command it
references.

path_info will now be checked more than before. Mainly because that is more
correct and more explicit and "better" to do it that way. It might also give
some safety.

86cbf8e6d76a
86cbf8e6d76a
86cbf8e6d76a
a3f0f00ff965
a3f0f00ff965
03bbd33bc084
9171248beae5
86cbf8e6d76a
9171248beae5
9171248beae5
9171248beae5
60e04a21bf0f
9171248beae5
9171248beae5
950110f3f99f
9171248beae5
950110f3f99f
c20adbaf16af
86cbf8e6d76a
86cbf8e6d76a

{% extends "basic/layout.html" %}

{% block sidebarlogo %}
<div style="text-align:center;margin:30px 0;">
  <img src="{{pathto('_static/kallithea-logo.svg',1)}}" width="200px"/>
</div>
<h3>Support Kallithea development</h3>
<div style="text-align:center">
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="hosted_button_id" value="EYXFS3SQPHYUL">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_donateCC_LG.gif" border="0" name="submit" alt="PayPal &ndash; The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>
    <div style="padding:5px">
     <a href="https://flattr.com/thing/922714/Donate-to-Software-Freedom-Conservancy" target="_blank">
     <img src="http://api.flattr.com/button/flattr-badge-large.png" alt="Flattr this" title="Flattr this" border="0" /></a>
    </div>
</div>
{% endblock %}}