{"thread":{"id":"16998","subject":"gitweb: removal of old style blobdiff support breaks ikiwiki","startedAt":"2009-01-05T23:54:18Z","lastAt":"2009-01-06T00:25:20Z","messageCount":2,"participants":["Joey Hess","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"99389","messageId":"20090105235418.GA9373@gnu.kitenet.net","threadId":"16998","inReplyTo":null,"subject":"gitweb: removal of old style blobdiff support breaks ikiwiki","fromName":"Joey Hess","fromEmail":"joeyh@debian.org","sentAt":"2009-01-05T23:54:18Z","receivedAt":"2009-01-05T23:54:18Z","isPatch":false,"sender":{"key":"joeyh@debian.org","avatar":null},"body":">  * debian/diff/0005-gitweb-do-not-run-git-diff-that-is-Porcelain.diff:\n>     new; fix possible gitweb vulnerability: calling \"git diff\": Jakub\n>     says that legacy-style URI to view two blob differences are never\n>     generated since 1.4.3.  This codepath runs \"git diff\" Porcelain from\n>     the gitweb, which is a no-no.  It can trigger diff.external command\n>     that is specified in the configuration file of the repository being\n>     viewed.\n\nJakub didn't know the whole picture. This change breaks ikiwiki\nconfigurations that use the old url form with gitweb. That url form\nis used in configuration examples that have probably been copied into a\nlot of ikiwiki setup files.\n\n(Who knows what else might rely on the old url form.. One other thing I've\nfound that does is various cut-n-pasted gitweb urls embedded on various\nwebsites..)\n\nI wonder if it wouldn't be better to make gitweb continue to support the\nold urls, using diff-tree instead of the porcelain?\n\nGerrit:\nI'll be releasing a new version of ikiwiki to that documents how to use\nthe new gitweb url form. The version in Debian testing would need to\nhave a new-ish feature backported into it to support the new url form at\nall. So please let me know if there are any plans to make this change to\nthe git in testing (or stable).\n\n-- \nsee shy jo\n"},{"id":"99391","messageId":"20090106002520.GA29000@coredump.intra.peff.net","threadId":"16998","inReplyTo":"20090105235418.GA9373@gnu.kitenet.net","subject":"Re: gitweb: removal of old style blobdiff support breaks ikiwiki","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2009-01-06T00:25:20Z","receivedAt":"2009-01-06T00:25:20Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Mon, Jan 05, 2009 at 06:54:18PM -0500, Joey Hess wrote:\n\n> I wonder if it wouldn't be better to make gitweb continue to support the\n> old urls, using diff-tree instead of the porcelain?\n\nIt can't; there is currently no interface for diffing two arbitrary\nblobs except \"git diff\". The simplest fix to retain functionality but\nplug the hole is to pass --no-ext-diff to all versions, and\n--no-textconv to versions which have textconv (i.e., 1.6.1 and later).\nIIRC, there is a problem with --no-ext-diff in some versions, so that\nfix might have to be backported, too.\n\n-Peff\n"}]}