jro_apps/redmine Commit - r1309:14a2b7e9b576

Verify rev and rev_to params format in RepositoriesController. And turn revision arguments into integers in SubversionAdapter....

Jean-Philippe Lang -

r1309:14a2b7e9b576

parent child

Context file:

r1309:14a2b7e9b576

Collapse all files

app/controllers/repositories_controller.rb +8 -3

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'SVG/Graph/Bar'
             require 'SVG/Graph/BarHorizontal'
             require 'digest/sha1'
-            class ChangesetNotFound < Exception
+            class ChangesetNotFound < Exception; end
-            end
+            class InvalidRevisionParam < Exception; end
             class RepositoriesController < ApplicationController
               layout 'base'
               menu_item :repository
               before_filter :find_repository, :except => :edit
               before_filter :find_project, :only => :edit
               before_filter :authorize
               accept_key_auth :revisions
               def edit
                 @repository = @project.repository
                 if !@repository
                   @repository = Repository.factory(params[:repository_scm])
                   @repository.project = @project
                 end
                 if request.post?
                   @repository.attributes = params[:repository]
                   @repository.save
                 end
                 render(:update) {|page| page.replace_html "tab-content-repository", :partial => 'projects/settings/repository'}
               end
               def destroy
                 @repository.destroy
                 redirect_to :controller => 'projects', :action => 'settings', :id => @project, :tab => 'repository'
               end
               def show
                 # check if new revisions have been committed in the repository
                 @repository.fetch_changesets if Setting.autofetch_changesets?
                 # get entries for the browse frame
                 @entries = @repository.entries('')
                 # latest changesets
                 @changesets = @repository.changesets.find(:all, :limit => 10, :order => "committed_on DESC")
                 show_error_not_found unless @entries || @changesets.any?
               rescue Redmine::Scm::Adapters::CommandFailed => e
                 show_error_command_failed(e.message)
               end
               def browse
                 @entries = @repository.entries(@path, @rev)
                 if request.xhr?
                   @entries ? render(:partial => 'dir_list_content') : render(:nothing => true)
                 else
                   show_error_not_found unless @entries
                 end
               rescue Redmine::Scm::Adapters::CommandFailed => e
                 show_error_command_failed(e.message)
               end
               def changes
                 @entry = @repository.scm.entry(@path, @rev)
                 show_error_not_found and return unless @entry
                 @changesets = @repository.changesets_for_path(@path)
               rescue Redmine::Scm::Adapters::CommandFailed => e
                 show_error_command_failed(e.message)
               end
               def revisions
                 @changeset_count = @repository.changesets.count
                 @changeset_pages = Paginator.new self, @changeset_count,
             								      per_page_option,
             								      params['page']
                 @changesets = @repository.changesets.find(:all,
             						:limit  =>  @changeset_pages.items_per_page,
             						:offset =>  @changeset_pages.current.offset)
                 respond_to do |format|
                   format.html { render :layout => false if request.xhr? }
                   format.atom { render_feed(@changesets, :title => "#{@project.name}: #{l(:label_revision_plural)}") }
                 end
               end
               def entry
                 @content = @repository.scm.cat(@path, @rev)
                 show_error_not_found and return unless @content
                 if 'raw' == params[:format] || @content.is_binary_data?
                   # Force the download if it's a binary file
                   send_data @content, :filename => @path.split('/').last
                 else
                   # Prevent empty lines when displaying a file with Windows style eol
                   @content.gsub!("\r\n", "\n")
                 end
               rescue Redmine::Scm::Adapters::CommandFailed => e
                 show_error_command_failed(e.message)
               end
               def annotate
                 @annotate = @repository.scm.annotate(@path, @rev)
                 render_error l(:error_scm_annotate) and return if @annotate.nil? || @annotate.empty?
               rescue Redmine::Scm::Adapters::CommandFailed => e
                 show_error_command_failed(e.message)
               end
               def revision
                 @changeset = @repository.changesets.find_by_revision(@rev)
                 raise ChangesetNotFound unless @changeset
                 @changes_count = @changeset.changes.size
                 @changes_pages = Paginator.new self, @changes_count, 150, params['page']
                 @changes = @changeset.changes.find(:all,
               						:limit  =>  @changes_pages.items_per_page,
               						:offset =>  @changes_pages.current.offset)
                 respond_to do |format|
                   format.html
                   format.js {render :layout => false}
                 end
               rescue ChangesetNotFound
                 show_error_not_found
               rescue Redmine::Scm::Adapters::CommandFailed => e
                 show_error_command_failed(e.message)
               end
               def diff
-                @rev_to = params[:rev_to]
                 @diff_type = params[:type] || User.current.pref[:diff_type] || 'inline'
                 @diff_type = 'inline' unless %w(inline sbs).include?(@diff_type)
                 # Save diff type as user preference
                 if User.current.logged? && @diff_type != User.current.pref[:diff_type]
                   User.current.pref[:diff_type] = @diff_type
                   User.current.preference.save
                 end
                 @cache_key = "repositories/diff/#{@repository.id}/" + Digest::MD5.hexdigest("#{@path}-#{@rev}-#{@rev_to}-#{@diff_type}")
                 unless read_fragment(@cache_key)
                   @diff = @repository.diff(@path, @rev, @rev_to, @diff_type)
                   show_error_not_found unless @diff
                 end
               rescue Redmine::Scm::Adapters::CommandFailed => e
                 show_error_command_failed(e.message)
               end
               def stats
               end
               def graph
                 data = nil
                 case params[:graph]
                 when "commits_per_month"
                   data = graph_commits_per_month(@repository)
                 when "commits_per_author"
                   data = graph_commits_per_author(@repository)
                 end
                 if data
                   headers["Content-Type"] = "image/svg+xml"
                   send_data(data, :type => "image/svg+xml", :disposition => "inline")
                 else
                   render_404
                 end
               end
             private
               def find_project
                 @project = Project.find(params[:id])
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
+              REV_PARAM_RE = %r{^[a-f0-9]*$}
               def find_repository
                 @project = Project.find(params[:id])
                 @repository = @project.repository
                 render_404 and return false unless @repository
                 @path = params[:path].join('/') unless params[:path].nil?
                 @path ||= ''
                 @rev = params[:rev]
+                @rev_to = params[:rev_to]
+                raise InvalidRevisionParam unless @rev.to_s.match(REV_PARAM_RE) && @rev.to_s.match(REV_PARAM_RE)
               rescue ActiveRecord::RecordNotFound
                 render_404
+              rescue InvalidRevisionParam
+                show_error_not_found
               end
               def show_error_not_found
                 render_error l(:error_scm_not_found)
               end
               def show_error_command_failed(msg)
                 render_error l(:error_scm_command_failed, msg)
               end
               def graph_commits_per_month(repository)
                 @date_to = Date.today
                 @date_from = @date_to << 11
                 @date_from = Date.civil(@date_from.year, @date_from.month, 1)
                 commits_by_day = repository.changesets.count(:all, :group => :commit_date, :conditions => ["commit_date BETWEEN ? AND ?", @date_from, @date_to])
                 commits_by_month = [0] * 12
                 commits_by_day.each {|c| commits_by_month[c.first.to_date.months_ago] += c.last }
                 changes_by_day = repository.changes.count(:all, :group => :commit_date, :conditions => ["commit_date BETWEEN ? AND ?", @date_from, @date_to])
                 changes_by_month = [0] * 12
                 changes_by_day.each {|c| changes_by_month[c.first.to_date.months_ago] += c.last }
                 fields = []
                 month_names = l(:actionview_datehelper_select_month_names_abbr).split(',')
 .times {|m| fields << month_names[((Date.today.month - 1 - m) % 12)]}
                 graph = SVG::Graph::Bar.new(
                   :height => 300,
                   :width => 500,
                   :fields => fields.reverse,
                   :stack => :side,
                   :scale_integers => true,
                   :step_x_labels => 2,
                   :show_data_values => false,
                   :graph_title => l(:label_commits_per_month),
                   :show_graph_title => true
                 )
                 graph.add_data(
                   :data => commits_by_month[0..11].reverse,
                   :title => l(:label_revision_plural)
                 )
                 graph.add_data(
                   :data => changes_by_month[0..11].reverse,
                   :title => l(:label_change_plural)
                 )
                 graph.burn
               end
               def graph_commits_per_author(repository)
                 commits_by_author = repository.changesets.count(:all, :group => :committer)
                 commits_by_author.sort! {|x, y| x.last <=> y.last}
                 changes_by_author = repository.changes.count(:all, :group => :committer)
                 h = changes_by_author.inject({}) {|o, i| o[i.first] = i.last; o}
                 fields = commits_by_author.collect {|r| r.first}
                 commits_data = commits_by_author.collect {|r| r.last}
                 changes_data = commits_by_author.collect {|r| h[r.first] || 0}
                 fields = fields + [""]*(10 - fields.length) if fields.length<10
                 commits_data = commits_data + [0]*(10 - commits_data.length) if commits_data.length<10
                 changes_data = changes_data + [0]*(10 - changes_data.length) if changes_data.length<10
                 graph = SVG::Graph::BarHorizontal.new(
                   :height => 300,
                   :width => 500,
                   :fields => fields,
                   :stack => :side,
                   :scale_integers => true,
                   :show_data_values => false,
                   :rotate_y_labels => false,
                   :graph_title => l(:label_commits_per_author),
                   :show_graph_title => true
                 )
                 graph.add_data(
                   :data => commits_data,
                   :title => l(:label_revision_plural)
                 )
                 graph.add_data(
                   :data => changes_data,
                   :title => l(:label_change_plural)
                 )
                 graph.burn
               end
             end
             class Date
               def months_ago(date = Date.today)
                 (date.year - self.year)*12 + (date.month - self.month)
               end
               def weeks_ago(date = Date.today)
                 (date.year - self.year)*52 + (date.cweek - self.cweek)
               end
             end
             class String
               def with_leading_slash
                 starts_with?('/') ? self : "/#{self}"
               end
             end

lib/redmine/scm/adapters/subversion_adapter.rb +6 -8

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require 'redmine/scm/adapters/abstract_adapter'
             require 'rexml/document'
             module Redmine
               module Scm
                 module Adapters
                   class SubversionAdapter < AbstractAdapter
                     # SVN executable name
                     SVN_BIN = "svn"
                     # Get info about the svn repository
                     def info
                       cmd = "#{SVN_BIN} info --xml #{target('')}"
                       cmd << credentials_string
                       info = nil
                       shellout(cmd) do |io|
                         begin
                           doc = REXML::Document.new(io)
                           #root_url = doc.elements["info/entry/repository/root"].text
                           info = Info.new({:root_url => doc.elements["info/entry/repository/root"].text,
                                            :lastrev => Revision.new({
                                              :identifier => doc.elements["info/entry/commit"].attributes['revision'],
                                              :time => Time.parse(doc.elements["info/entry/commit/date"].text).localtime,
                                              :author => (doc.elements["info/entry/commit/author"] ? doc.elements["info/entry/commit/author"].text : "")
                                            })
                                          })
                         rescue
                         end
                       end
                       return nil if $? && $?.exitstatus != 0
                       info
                     rescue CommandFailed
                       return nil
                     end
                     # Returns the entry identified by path and revision identifier
                     # or nil if entry doesn't exist in the repository
                     def entry(path=nil, identifier=nil)
                       e = entries(path, identifier)
                       e ? e.first : nil
                     end
                     # Returns an Entries collection
                     # or nil if the given path doesn't exist in the repository
                     def entries(path=nil, identifier=nil)
                       path ||= ''
-                      identifier = 'HEAD' unless identifier and identifier > 0
+                      identifier = (identifier and identifier.to_i > 0) ? identifier.to_i : "HEAD"
                       entries = Entries.new
                       cmd = "#{SVN_BIN} list --xml #{target(path)}@#{identifier}"
                       cmd << credentials_string
                       shellout(cmd) do |io|
                         output = io.read
                         begin
                           doc = REXML::Document.new(output)
                           doc.elements.each("lists/list/entry") do |entry|
                             entries << Entry.new({:name => entry.elements['name'].text,
                                         :path => ((path.empty? ? "" : "#{path}/") + entry.elements['name'].text),
                                         :kind => entry.attributes['kind'],
                                         :size => (entry.elements['size'] and entry.elements['size'].text).to_i,
                                         :lastrev => Revision.new({
                                           :identifier => entry.elements['commit'].attributes['revision'],
                                           :time => Time.parse(entry.elements['commit'].elements['date'].text).localtime,
                                           :author => (entry.elements['commit'].elements['author'] ? entry.elements['commit'].elements['author'].text : "")
                                           })
                                         })
                           end
                         rescue Exception => e
                           logger.error("Error parsing svn output: #{e.message}")
                           logger.error("Output was:\n #{output}")
                         end
                       end
                       return nil if $? && $?.exitstatus != 0
                       logger.debug("Found #{entries.size} entries in the repository for #{target(path)}") if logger && logger.debug?
                       entries.sort_by_name
                     end
                     def revisions(path=nil, identifier_from=nil, identifier_to=nil, options={})
                       path ||= ''
-                      identifier_from = 'HEAD' unless identifier_from and identifier_from.to_i > 0
+                      identifier_from = (identifier_from and identifier_from.to_i > 0) ? identifier_from.to_i : "HEAD"
-                      identifier_to = 1 unless identifier_to and identifier_to.to_i > 0
+                      identifier_to = (identifier_to and identifier_to.to_i > 0) ? identifier_to.to_i : 1
                       revisions = Revisions.new
                       cmd = "#{SVN_BIN} log --xml -r #{identifier_from}:#{identifier_to}"
                       cmd << credentials_string
                       cmd << " --verbose " if  options[:with_paths]
                       cmd << ' ' + target(path)
                       shellout(cmd) do |io|
                         begin
                           doc = REXML::Document.new(io)
                           doc.elements.each("log/logentry") do |logentry|
                             paths = []
                             logentry.elements.each("paths/path") do |path|
                               paths << {:action => path.attributes['action'],
                                         :path => path.text,
                                         :from_path => path.attributes['copyfrom-path'],
                                         :from_revision => path.attributes['copyfrom-rev']
                                         }
                             end
                             paths.sort! { |x,y| x[:path] <=> y[:path] }
                             revisions << Revision.new({:identifier => logentry.attributes['revision'],
                                           :author => (logentry.elements['author'] ? logentry.elements['author'].text : ""),
                                           :time => Time.parse(logentry.elements['date'].text).localtime,
                                           :message => logentry.elements['msg'].text,
                                           :paths => paths
                                         })
                           end
                         rescue
                         end
                       end
                       return nil if $? && $?.exitstatus != 0
                       revisions
                     end
                     def diff(path, identifier_from, identifier_to=nil, type="inline")
                       path ||= ''
-                      if identifier_to and identifier_to.to_i > 0
+                      identifier_from = (identifier_from and identifier_from.to_i > 0) ? identifier_from.to_i : ''
-                        identifier_to = identifier_to.to_i
+                      identifier_to = (identifier_to and identifier_to.to_i > 0) ? identifier_to.to_i : (identifier_from.to_i - 1)
-                      else
-                        identifier_to = identifier_from.to_i - 1
-                      end
                       cmd = "#{SVN_BIN} diff -r "
                       cmd << "#{identifier_to}:"
                       cmd << "#{identifier_from}"
                       cmd << " #{target(path)}@#{identifier_from}"
                       cmd << credentials_string
                       diff = []
                       shellout(cmd) do |io|
                         io.each_line do |line|
                           diff << line
                         end
                       end
                       return nil if $? && $?.exitstatus != 0
                       DiffTableList.new diff, type
                     end
                     def cat(path, identifier=nil)
                       identifier = (identifier and identifier.to_i > 0) ? identifier.to_i : "HEAD"
                       cmd = "#{SVN_BIN} cat #{target(path)}@#{identifier}"
                       cmd << credentials_string
                       cat = nil
                       shellout(cmd) do |io|
                         io.binmode
                         cat = io.read
                       end
                       return nil if $? && $?.exitstatus != 0
                       cat
                     end
                     def annotate(path, identifier=nil)
                       identifier = (identifier and identifier.to_i > 0) ? identifier.to_i : "HEAD"
                       cmd = "#{SVN_BIN} blame #{target(path)}@#{identifier}"
                       cmd << credentials_string
                       blame = Annotate.new
                       shellout(cmd) do |io|
                         io.each_line do |line|
                           next unless line =~ %r{^\s*(\d+)\s*(\S+)\s(.*)$}
                           blame.add_line($3.rstrip, Revision.new(:identifier => $1.to_i, :author => $2.strip))
                         end
                       end
                       return nil if $? && $?.exitstatus != 0
                       blame
                     end
                     private
                     def credentials_string
                       str = ''
                       str << " --username #{shell_quote(@login)}" unless @login.blank?
                       str << " --password #{shell_quote(@password)}" unless @login.blank? || @password.blank?
                       str
                     end
                   end
                 end
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages