kallithea Files · init.d/kallithea-upstart.conf

Files @ 109b068ba6e5

Branch filter:

Location: kallithea/init.d/kallithea-upstart.conf

109b068ba6e5 759 B text/plain Show Annotation Show as Raw Download as Raw

Mads Kiilerich

templates/summary: escape branch/tag/bookmark names in 'Download as zip' links to prevent XSS

On a repository summary page, in the 'Download' section where you can
download an archive of the repository at a given revision, the branch/tag
names were not correctly escaped.

This means that if an attacker is able to push a branch/tag/bookmark
containing HTML/JavaScript in its name, then that code would be evaluated.
This is a cross-site scripting (XSS) vulnerability.

Fix the problem by correctly escaping the branch/tag/bookmarks.

Reported by Bob Hogg <wombat@rwhogg.site> (thanks!).

# kallithea - run the kallithea daemon as an upstart job
# Change variables/paths as necessary and place file /etc/init/kallithea.conf
# start/stop/restart as normal upstart job (ie: $ start kallithea)

description     "Kallithea Mercurial Server"
author          "Matt Zuba <matt.zuba@goodwillaz.org"

start on (local-filesystems and runlevel [2345])
stop on runlevel [!2345]

respawn

umask 0022

env PIDFILE=/var/hg/kallithea/kallithea.pid
env LOGFILE=/var/hg/kallithea/log/kallithea.log
env APPINI=/var/hg/kallithea/production.ini
env HOME=/var/hg
env USER=hg
env GROUP=hg

exec /var/hg/.virtualenvs/kallithea/bin/gearbox serve --user=$USER --group=$GROUP --pid-file=$PIDFILE --log-file=$LOGFILE -c $APPINI

post-stop script
    rm -f $PIDFILE
end script