jro_apps/redmine Commit - r1309:14a2b7e9b576

Verify rev and rev_to params format in RepositoriesController. And turn revision arguments into integers in SubversionAdapter....

Jean-Philippe Lang -

r1309:14a2b7e9b576

parent child

Context file:

r1309:14a2b7e9b576

Collapse all files

app/controllers/repositories_controller.rb +8 -3

             require 'SVG/Graph/BarHorizontal'
             require 'digest/sha1'
-            class ChangesetNotFound < Exception
+            class ChangesetNotFound < Exception; end
-            end
+            class InvalidRevisionParam < Exception; end
             class RepositoriesController < ApplicationController
               layout 'base'
               end
               def diff
-                @rev_to = params[:rev_to]
                 @diff_type = params[:type] || User.current.pref[:diff_type] || 'inline'
                 @diff_type = 'inline' unless %w(inline sbs).include?(@diff_type)
                 render_404
               end
+              REV_PARAM_RE = %r{^[a-f0-9]*$}
               def find_repository
                 @project = Project.find(params[:id])
                 @repository = @project.repository
                 @path = params[:path].join('/') unless params[:path].nil?
                 @path ||= ''
                 @rev = params[:rev]
+                @rev_to = params[:rev_to]
+                raise InvalidRevisionParam unless @rev.to_s.match(REV_PARAM_RE) && @rev.to_s.match(REV_PARAM_RE)
               rescue ActiveRecord::RecordNotFound
                 render_404
+              rescue InvalidRevisionParam
+                show_error_not_found
               end
               def show_error_not_found

lib/redmine/scm/adapters/subversion_adapter.rb +6 -8

                     # or nil if the given path doesn't exist in the repository
                     def entries(path=nil, identifier=nil)
                       path ||= ''
-                      identifier = 'HEAD' unless identifier and identifier > 0
+                      identifier = (identifier and identifier.to_i > 0) ? identifier.to_i : "HEAD"
                       entries = Entries.new
                       cmd = "#{SVN_BIN} list --xml #{target(path)}@#{identifier}"
                       cmd << credentials_string
                     def revisions(path=nil, identifier_from=nil, identifier_to=nil, options={})
                       path ||= ''
-                      identifier_from = 'HEAD' unless identifier_from and identifier_from.to_i > 0
+                      identifier_from = (identifier_from and identifier_from.to_i > 0) ? identifier_from.to_i : "HEAD"
-                      identifier_to = 1 unless identifier_to and identifier_to.to_i > 0
+                      identifier_to = (identifier_to and identifier_to.to_i > 0) ? identifier_to.to_i : 1
                       revisions = Revisions.new
                       cmd = "#{SVN_BIN} log --xml -r #{identifier_from}:#{identifier_to}"
                       cmd << credentials_string
                     def diff(path, identifier_from, identifier_to=nil, type="inline")
                       path ||= ''
-                      if identifier_to and identifier_to.to_i > 0
+                      identifier_from = (identifier_from and identifier_from.to_i > 0) ? identifier_from.to_i : ''
-                        identifier_to = identifier_to.to_i
+                      identifier_to = (identifier_to and identifier_to.to_i > 0) ? identifier_to.to_i : (identifier_from.to_i - 1)
-                      else
-                        identifier_to = identifier_from.to_i - 1
-                      end
                       cmd = "#{SVN_BIN} diff -r "
                       cmd << "#{identifier_to}:"
                       cmd << "#{identifier_from}"

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages