File git-prevent_xss-default.diff of Package cgit

Overview Repositories Revisions Requests Users Attributes Meta

File git-prevent_xss-default.diff of Package cgit

From: Jakub Narebski <jnareb@...il.com>
Subject: [PATCH] gitweb: Enable $prevent_xss by default

This fixes issue CVE-2011-2186 originally reported in
https://launchpad.net/bugs/777804

Reported-by: dave b <db.pub.mail@...il.com>
Signed-off-by: Jakub Narebski <jnareb@...il.com>
---
 git-instaweb.sh    |    4 ++++
 gitweb/README      |    5 +++--
 gitweb/gitweb.perl |    2 +-
 3 files changed, 8 insertions(+), 3 deletions(-)

--- a/git-instaweb.sh
+++ b/git-instaweb.sh
@@ -580,6 +580,10 @@
 our \$projectroot = "$(dirname "$fqgitdir")";
 our \$git_temp = "$fqgitdir/gitweb/tmp";
 our \$projects_list = \$projectroot;
+
+# we can trust our own repository, so disable XSS prevention
+# to enable some extra features
+our \$prevent_xss = 0;
 EOF
 }
 
--- a/gitweb/README
+++ b/gitweb/README
@@ -229,8 +229,9 @@
  * $prevent_xss
    If true, some gitweb features are disabled to prevent content in
    repositories from launching cross-site scripting (XSS) attacks.  Set this
-   to true if you don't trust the content of your repositories. The default
-   is false.
+   to false if you trust the content of your repositories, and want to use
+   per-repository README.html, or use gitweb as deployment platform
+   via 'blob_plain' view and path_info links. The default is true.
  * $maxload
    Used to set the maximum load that we will still respond to gitweb queries.
    If server load exceed this value then return "503 Service Unavailable" error.
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -164,7 +164,7 @@
 
 # Disables features that would allow repository owners to inject script into
 # the gitweb domain.
-our $prevent_xss = 0;
+our $prevent_xss = 1;
 
 # information about snapshot formats that gitweb is capable of serving
 our %known_snapshot_formats = (

Places

File git-prevent_xss-default.diff of Package cgit

Places