Re: [PATCH/RFT] cvsserver: only allow checkout of branches

[Johannes Schindelin <Johannes.Schindelin@gmx.de>]

Hi,

On Thu, 4 Oct 2007, Frank Lichtenheld wrote:

> On Thu, Oct 04, 2007 at 04:29:04PM +0100, Johannes Schindelin wrote:
> > diff --git a/git-cvsserver.perl b/git-cvsserver.perl
> > index 13dbd27..869690c 100755
> > --- a/git-cvsserver.perl
> > +++ b/git-cvsserver.perl
> > @@ -770,6 +770,14 @@ sub req_co
> >  
> >      $log->debug("req_co : " . ( defined($data) ? $data : "[NULL]" ) );
> >  
> > +    if( system("git", "rev-parse", "--verify", "refs/heads/$module" ) != 0 )
> > +    {
> > +	$log->warn("Checkout failed: $module is not a branch");
> > +	print "error 1 Checkout failed: $module is not a branch\n";
> > +	chdir "/";
> > +	exit;
> > +    }
> > +
> >      $log->info("Checking out module '$module' ($state->{CVSROOT}) to '$checkout_path'");
> >  
> >      $ENV{GIT_DIR} = $state->{CVSROOT} . "/";
> 
> I've found a problem with the patch. Since git-rev-parse will produce
> output (which will end up at the client and confuse it), we will have to use a fork/exec
> combination instead of system to be able to close STDOUT and STDERR of the child.
> 
> Should I sent a patch on top of this one or as a replacement?

Better a replacement.  Otherwise I have to fly to California with a brown 
paper bag over my HEAD.

Ciao,
Dscho