development/git
development/git
1
0
Fork 0
mirror of https://github.com/git/git synced 2024-07-17 02:57:48 +00:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Merge branch 'jn/mime-type-with-params' into maint

Browse source 
* jn/mime-type-with-params:
  gitweb: Serve */*+xml 'blob_plain' as text/plain with $prevent_xss
  gitweb: Serve text/* 'blob_plain' as text/plain with $prevent_xss
This commit is contained in:
Junio C Hamano 2011-08-16 11:41:26 -07:00
parent 4a5a8008fd e8c3531717
commit 5329c99795
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
gitweb/gitweb.perl
View file

@ -6129,7 +6129,16 @@ sub git_blob_plain {
# want to be sure not to break that by serving the image as an
# attachment (though Firefox 3 doesn't seem to care).
my $sandbox = $prevent_xss &&
$type !~ m!^(?:text/plain|image/(?:gif|png|jpeg))(?:[ ;]|$)!;
$type !~ m!^(?:text/[a-z]+|image/(?:gif|png|jpeg))(?:[ ;]|$)!;
# serve text/* as text/plain
if ($prevent_xss &&
($type =~ m!^text/[a-z]+\b(.*)$! ||
($type =~ m!^[a-z]+/[a-z]\+xml\b(.*)$! && -T $fd))) {
my $rest = $1;
$rest = defined $rest ? $rest : '';
$type = "text/plain$rest";
}
print $cgi->header(
-type => $type,