* [PATCH] gitweb fix validating pg (page) parameter
@ 2006-09-17 11:52 Matthias Lederhofer
2006-09-17 21:21 ` Junio C Hamano
0 siblings, 1 reply; 4+ messages in thread
From: Matthias Lederhofer @ 2006-09-17 11:52 UTC (permalink / raw)
To: git
Currently it is possible to give any string ending with a number as
page. -1 for example is quite bad (error log shows probably 100
warnings).
---
gitweb/gitweb.perl | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 497129a..346c15c 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -259,7 +259,7 @@ if (defined $hash_parent_base) {
our $page = $cgi->param('pg');
if (defined $page) {
- if ($page =~ m/[^0-9]$/) {
+ if ($page =~ m/[^0-9]/) {
die_error(undef, "Invalid page parameter");
}
}
--
1.4.2.1.ge767
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] gitweb fix validating pg (page) parameter
2006-09-17 11:52 [PATCH] gitweb fix validating pg (page) parameter Matthias Lederhofer
@ 2006-09-17 21:21 ` Junio C Hamano
2006-09-17 21:38 ` Matthias Lederhofer
0 siblings, 1 reply; 4+ messages in thread
From: Junio C Hamano @ 2006-09-17 21:21 UTC (permalink / raw)
To: Matthias Lederhofer; +Cc: git
Matthias Lederhofer <matled@gmx.net> writes:
> Currently it is possible to give any string ending with a number as
> page. -1 for example is quite bad (error log shows probably 100
> warnings).
>
> @@ -259,7 +259,7 @@ if (defined $hash_parent_base) {
>
> our $page = $cgi->param('pg');
> if (defined $page) {
> - if ($page =~ m/[^0-9]$/) {
> + if ($page =~ m/[^0-9]/) {
> die_error(undef, "Invalid page parameter");
> }
> }
Are we complaining if $page is not a validly formatted number
here? If so why not
unless ($page =~ /^\d+$/ && 1 <= $page) {
barf(...);
}
???
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] gitweb fix validating pg (page) parameter
2006-09-17 21:21 ` Junio C Hamano
@ 2006-09-17 21:38 ` Matthias Lederhofer
2006-09-17 21:45 ` Junio C Hamano
0 siblings, 1 reply; 4+ messages in thread
From: Matthias Lederhofer @ 2006-09-17 21:38 UTC (permalink / raw)
To: Junio C Hamano; +Cc: git
Junio C Hamano <junkio@cox.net> wrote:
> Matthias Lederhofer <matled@gmx.net> writes:
>
> > Currently it is possible to give any string ending with a number as
> > page. -1 for example is quite bad (error log shows probably 100
> > warnings).
> >
> > @@ -259,7 +259,7 @@ if (defined $hash_parent_base) {
> >
> > our $page = $cgi->param('pg');
> > if (defined $page) {
> > - if ($page =~ m/[^0-9]$/) {
> > + if ($page =~ m/[^0-9]/) {
> > die_error(undef, "Invalid page parameter");
> > }
> > }
>
> Are we complaining if $page is not a validly formatted number
> here? If so why not
>
> unless ($page =~ /^\d+$/ && 1 <= $page) {
> barf(...);
> }
The first page seems to have number 0. After removing the 1 <= $page
this code should do the same as my patch, apply whatever you think is
easier to read (I prefer if over unless most of the time).
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] gitweb fix validating pg (page) parameter
2006-09-17 21:38 ` Matthias Lederhofer
@ 2006-09-17 21:45 ` Junio C Hamano
0 siblings, 0 replies; 4+ messages in thread
From: Junio C Hamano @ 2006-09-17 21:45 UTC (permalink / raw)
To: Matthias Lederhofer; +Cc: git
Matthias Lederhofer <matled@gmx.net> writes:
>> > + if ($page =~ m/[^0-9]/) {
>...
> The first page seems to have number 0. After removing the 1 <= $page
> this code should do the same as my patch, apply whatever you think is
> easier to read (I prefer if over unless most of the time).
Ah, I did not notice we call the first page 0; barfing on any
non-digit in the string like you do sounds quite sane.
Thanks.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2006-09-17 21:45 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-09-17 11:52 [PATCH] gitweb fix validating pg (page) parameter Matthias Lederhofer
2006-09-17 21:21 ` Junio C Hamano
2006-09-17 21:38 ` Matthias Lederhofer
2006-09-17 21:45 ` Junio C Hamano
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).