jro_apps/redmine Commit - r4425:7d7c67dabad1

Fixed that some arguments where not properly escaped in scm adapters....

Jean-Philippe Lang -

r4425:7d7c67dabad1

parent child

Context file:

r4425:7d7c67dabad1

Collapse all files

lib/redmine/scm/adapters/bazaar_adapter.rb +6 -3

                     def revisions(path=nil, identifier_from=nil, identifier_to=nil, options={})
                       path ||= ''
-                      identifier_from = 'last:1' unless identifier_from and identifier_from.to_i > 0
+                      identifier_from = (identifier_from and identifier_from.to_i > 0) ? identifier_from.to_i : 'last:1'
-                      identifier_to = 1 unless identifier_to and identifier_to.to_i > 0
+                      identifier_to = (identifier_to and identifier_to.to_i > 0) ? identifier_to.to_i : 1
                       revisions = Revisions.new
-                      cmd = "#{BZR_BIN} log -v --show-ids -r#{identifier_to.to_i}..#{identifier_from} #{target(path)}"
+                      cmd = "#{BZR_BIN} log -v --show-ids -r#{identifier_to}..#{identifier_from} #{target(path)}"
                       shellout(cmd) do |io|
                         revision = nil
                         parsing = nil
                       else
                         identifier_to = identifier_from.to_i - 1
                       end
+                      if identifier_from
+                        identifier_from = identifier_from.to_i
+                      end
                       cmd = "#{BZR_BIN} diff -r#{identifier_to}..#{identifier_from} #{target(path)}"
                       diff = []
                       shellout(cmd) do |io|

lib/redmine/scm/adapters/cvs_adapter.rb +6 -6

                       logger.debug "<cvs> entries '#{path}' with identifier '#{identifier}'"
                       path_with_project="#{url}#{with_leading_slash(path)}"
                       entries = Entries.new
-                      cmd = "#{CVS_BIN} -d #{root_url} rls -e"
+                      cmd = "#{CVS_BIN} -d #{shell_quote root_url} rls -e"
                       cmd << " -D \"#{time_to_cvstime(identifier)}\"" if identifier
                       cmd << " #{shell_quote path_with_project}"
                       shellout(cmd) do |io|
                       logger.debug "<cvs> revisions path:'#{path}',identifier_from #{identifier_from}, identifier_to #{identifier_to}"
                       path_with_project="#{url}#{with_leading_slash(path)}"
-                      cmd = "#{CVS_BIN} -d #{root_url} rlog"
+                      cmd = "#{CVS_BIN} -d #{shell_quote root_url} rlog"
                       cmd << " -d\">#{time_to_cvstime(identifier_from)}\"" if identifier_from
                       cmd << " #{shell_quote path_with_project}"
                       shellout(cmd) do |io|
                     def diff(path, identifier_from, identifier_to=nil)
                       logger.debug "<cvs> diff path:'#{path}',identifier_from #{identifier_from}, identifier_to #{identifier_to}"
                       path_with_project="#{url}#{with_leading_slash(path)}"
-                      cmd = "#{CVS_BIN} -d #{root_url} rdiff -u -r#{identifier_to} -r#{identifier_from} #{shell_quote path_with_project}"
+                      cmd = "#{CVS_BIN} -d #{shell_quote root_url} rdiff -u -r#{identifier_to.to_i} -r#{identifier_from.to_i} #{shell_quote path_with_project}"
                       diff = []
                       shellout(cmd) do |io|
                         io.each_line do |line|
                       identifier = (identifier) ? identifier : "HEAD"
                       logger.debug "<cvs> cat path:'#{path}',identifier #{identifier}"
                       path_with_project="#{url}#{with_leading_slash(path)}"
-                      cmd = "#{CVS_BIN} -d #{root_url} co"
+                      cmd = "#{CVS_BIN} -d #{shell_quote root_url} co"
                       cmd << " -D \"#{time_to_cvstime(identifier)}\"" if identifier
                       cmd << " -p #{shell_quote path_with_project}"
                       cat = nil
                     end
                     def annotate(path, identifier=nil)
-                      identifier = (identifier) ? identifier : "HEAD"
+                      identifier = (identifier) ? identifier.to_i : "HEAD"
                       logger.debug "<cvs> annotate path:'#{path}',identifier #{identifier}"
                       path_with_project="#{url}#{with_leading_slash(path)}"
-                      cmd = "#{CVS_BIN} -d #{root_url} rannotate -r#{identifier} #{shell_quote path_with_project}"
+                      cmd = "#{CVS_BIN} -d #{shell_quote root_url} rannotate -r#{identifier} #{shell_quote path_with_project}"
                       blame = Annotate.new
                       shellout(cmd) do |io|
                         io.each_line do |line|

lib/redmine/scm/adapters/darcs_adapter.rb +5 -5

                       path_prefix = (path.blank? ? '' : "#{path}/")
                       path = '.' if path.blank?
                       entries = Entries.new
-                      cmd = "#{DARCS_BIN} annotate --repodir #{@url} --xml-output"
+                      cmd = "#{DARCS_BIN} annotate --repodir #{shell_quote @url} --xml-output"
                       cmd << " --match #{shell_quote("hash #{identifier}")}" if identifier
                       cmd << " #{shell_quote path}"
                       shellout(cmd) do |io|
                     def revisions(path=nil, identifier_from=nil, identifier_to=nil, options={})
                       path = '.' if path.blank?
                       revisions = Revisions.new
-                      cmd = "#{DARCS_BIN} changes --repodir #{@url} --xml-output"
+                      cmd = "#{DARCS_BIN} changes --repodir #{shell_quote @url} --xml-output"
                       cmd << " --from-match #{shell_quote("hash #{identifier_from}")}" if identifier_from
                       cmd << " --last #{options[:limit].to_i}" if options[:limit]
                       shellout(cmd) do |io|
                     def diff(path, identifier_from, identifier_to=nil)
                       path = '*' if path.blank?
-                      cmd = "#{DARCS_BIN} diff --repodir #{@url}"
+                      cmd = "#{DARCS_BIN} diff --repodir #{shell_quote @url}"
                       if identifier_to.nil?
                         cmd << " --match #{shell_quote("hash #{identifier_from}")}"
                       else
                     end
                     def cat(path, identifier=nil)
-                      cmd = "#{DARCS_BIN} show content --repodir #{@url}"
+                      cmd = "#{DARCS_BIN} show content --repodir #{shell_quote @url}"
                       cmd << " --match #{shell_quote("hash #{identifier}")}" if identifier
                       cmd << " #{shell_quote path}"
                       cat = nil
                     # Retrieve changed paths for a single patch
                     def get_paths_for_patch(hash)
-                      cmd = "#{DARCS_BIN} annotate --repodir #{@url} --summary --xml-output"
+                      cmd = "#{DARCS_BIN} annotate --repodir #{shell_quote @url} --summary --xml-output"
                       cmd << " --match #{shell_quote("hash #{hash}")} "
                       paths = []
                       shellout(cmd) do |io|

lib/redmine/scm/adapters/git_adapter.rb +1 -1

                       cmd = "#{GIT_BIN} --git-dir #{target('')} log --no-color --raw --date=iso --pretty=fuller "
                       cmd << " --reverse " if options[:reverse]
                       cmd << " --all " if options[:all]
-                      cmd << " -n #{options[:limit]} " if options[:limit]
+                      cmd << " -n #{options[:limit].to_i} " if options[:limit]
                       cmd << "#{shell_quote(identifier_from + '..')}" if identifier_from
                       cmd << "#{shell_quote identifier_to}" if identifier_to
                       cmd << " --since=#{shell_quote(options[:since].strftime("%Y-%m-%d %H:%M:%S"))}" if options[:since]

lib/redmine/scm/adapters/mercurial_adapter.rb +7 -4

                       path ||= ''
                       entries = Entries.new
                       cmd = "#{HG_BIN} -R #{target('')} --cwd #{target('')} locate"
-                      cmd << " -r " + (identifier ? identifier.to_s : "tip")
+                      cmd << " -r " + shell_quote(identifier ? identifier.to_s : "tip")
                       cmd << " " + shell_quote("path:#{path}") unless path.empty?
                       shellout(cmd) do |io|
                         io.each_line do |line|
                         cmd << " -r #{identifier_from.to_i}:"
                       end
                       cmd << " --limit #{options[:limit].to_i}" if options[:limit]
-                      cmd << " #{path}" if path
+                      cmd << " #{shell_quote path}" if path
                       shellout(cmd) do |io|
                         begin
                           # HG doesn't close the XML Document...
                       else
                         identifier_to = identifier_from.to_i - 1
                       end
+                      if identifier_from
+                        identifier_from = identifier_from.to_i
+                      end
                       cmd = "#{HG_BIN} -R #{target('')} diff -r #{identifier_to} -r #{identifier_from} --nodates"
                       cmd << " -I #{target(path)}" unless path.empty?
                       diff = []
                     def cat(path, identifier=nil)
                       cmd = "#{HG_BIN} -R #{target('')} cat"
-                      cmd << " -r " + (identifier ? identifier.to_s : "tip")
+                      cmd << " -r " + shell_quote(identifier ? identifier.to_s : "tip")
                       cmd << " #{target(path)}"
                       cat = nil
                       shellout(cmd) do |io|
                       path ||= ''
                       cmd = "#{HG_BIN} -R #{target('')}"
                       cmd << " annotate -n -u"
-                      cmd << " -r " + (identifier ? identifier.to_s : "tip")
+                      cmd << " -r " + shell_quote(identifier ? identifier.to_s : "tip")
                       cmd << " -r #{identifier.to_i}" if identifier
                       cmd << " #{target(path)}"
                       blame = Annotate.new

lib/redmine/scm/adapters/subversion_adapter.rb +2 -2

                     def revisions(path=nil, identifier_from=nil, identifier_to=nil, options={})
                       path ||= ''
-                      identifier_from = (identifier_from and identifier_from.to_i > 0) ? identifier_from.to_i : "HEAD"
+                      identifier_from = (identifier_from && identifier_from.to_i > 0) ? identifier_from.to_i : "HEAD"
-                      identifier_to = (identifier_to and identifier_to.to_i > 0) ? identifier_to.to_i : 1
+                      identifier_to = (identifier_to && identifier_to.to_i > 0) ? identifier_to.to_i : 1
                       revisions = Revisions.new
                       cmd = "#{SVN_BIN} log --xml -r #{identifier_from}:#{identifier_to}"
                       cmd << credentials_string

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages