Re: [PATCH/RFT] cvsserver: only allow checkout of branches

Hi,

On Thu, 4 Oct 2007, Frank Lichtenheld wrote:

On Thu, Oct 04, 2007 at 04:29:04PM +0100, Johannes Schindelin wrote:

quoted

diff --git a/git-cvsserver.perl b/git-cvsserver.perl
index 13dbd27..869690c 100755
--- a/git-cvsserver.perl
+++ b/git-cvsserver.perl

@@ -770,6 +770,14 @@ sub req_co
 
     $log->debug("req_co : " . ( defined($data) ? $data : "[NULL]" ) );
 
+    if( system("git", "rev-parse", "--verify", "refs/heads/$module" ) != 0 )
+    {
+	$log->warn("Checkout failed: $module is not a branch");
+	print "error 1 Checkout failed: $module is not a branch\n";
+	chdir "/";
+	exit;
+    }
+
     $log->info("Checking out module '$module' ($state->{CVSROOT}) to '$checkout_path'");
 
     $ENV{GIT_DIR} = $state->{CVSROOT} . "/";

I've found a problem with the patch. Since git-rev-parse will produce
output (which will end up at the client and confuse it), we will have to use a fork/exec
combination instead of system to be able to close STDOUT and STDERR of the child.

Should I sent a patch on top of this one or as a replacement?

Better a replacement.  Otherwise I have to fly to California with a brown 
paper bag over my HEAD.

Ciao,
Dscho