{"thread":{"id":"4866","subject":"[PATCH] gitweb: Make command invocations go through the git wrapper","startedAt":"2006-07-12T22:55:10Z","lastAt":"2006-07-12T22:55:10Z","messageCount":1,"participants":["Alp Toker"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"23730","messageId":"11527449102604-git-send-email-alp@atoker.com","threadId":"4866","inReplyTo":null,"subject":"[PATCH] gitweb: Make command invocations go through the git wrapper","fromName":"Alp Toker","fromEmail":"alp@atoker.com","sentAt":"2006-07-12T22:55:10Z","receivedAt":"2006-07-12T22:55:10Z","isPatch":true,"sender":{"key":"alp@atoker.com","avatar":"https://gravatar.com/avatar/5367b73f1bb2598314e084847e4f45c303514c7fd192cfa9aa3c3437511567cd?d=mp&s=160"},"body":"This patch makes invocations of core git commands go through the 'git'\nbinary itself, which improves readability and might help system\nadministrators lock down their CGI environment for security.\n\nSigned-off-by: Alp Toker <alp@atoker.com>\n---\n gitweb/gitweb.cgi |   62 +++++++++++++++++++++++++----------------------------\n 1 files changed, 29 insertions(+), 33 deletions(-)\n\ndiff --git a/gitweb/gitweb.cgi b/gitweb/gitweb.cgi\nindex 3d9fa44..2fd1e5f 100755\n--- a/gitweb/gitweb.cgi\n+++ b/gitweb/gitweb.cgi\n@@ -22,20 +22,16 @@ our $my_url = $cgi->url();\n our $my_uri = $cgi->url(-absolute => 1);\n our $rss_link = \"\";\n \n-# location of the git-core binaries\n-our $gitbin = \"/usr/bin\";\n+# core git executable to use\n+# this can just be \"git\" if your webserver has a sensible PATH\n+our $GIT = \"/usr/bin/git\";\n \n # absolute fs-path which will be prepended to the project path\n #our $projectroot = \"/pub/scm\";\n our $projectroot = \"/home/kay/public_html/pub/scm\";\n \n-# version of the git-core binaries\n-our $git_version = qx($gitbin/git --version);\n-if ($git_version =~ m/git version (.*)$/) {\n-\t$git_version = $1;\n-} else {\n-\t$git_version = \"unknown\";\n-}\n+# version of the core git binary\n+our $git_version = qx($GIT --version) =~ m/git version (.*)$/ ? $1 : \"unknown\";\n \n # location for temporary files needed for diffs\n our $git_temp = \"/tmp/gitweb\";\n@@ -392,7 +388,7 @@ sub die_error {\n sub git_get_type {\n \tmy $hash = shift;\n \n-\topen my $fd, \"-|\", \"$gitbin/git-cat-file -t $hash\" or return;\n+\topen my $fd, \"-|\", \"$GIT cat-file -t $hash\" or return;\n \tmy $type = <$fd>;\n \tclose $fd or return;\n \tchomp $type;\n@@ -404,7 +400,7 @@ sub git_read_head {\n \tmy $oENV = $ENV{'GIT_DIR'};\n \tmy $retval = undef;\n \t$ENV{'GIT_DIR'} = \"$projectroot/$project\";\n-\tif (open my $fd, \"-|\", \"$gitbin/git-rev-parse\", \"--verify\", \"HEAD\") {\n+\tif (open my $fd, \"-|\", $GIT, \"rev-parse\", \"--verify\", \"HEAD\") {\n \t\tmy $head = <$fd>;\n \t\tclose $fd;\n \t\tif (defined $head && $head =~ /^([0-9a-fA-F]{40})$/) {\n@@ -444,7 +440,7 @@ sub git_read_tag {\n \tmy %tag;\n \tmy @comment;\n \n-\topen my $fd, \"-|\", \"$gitbin/git-cat-file tag $tag_id\" or return;\n+\topen my $fd, \"-|\", \"$GIT cat-file tag $tag_id\" or return;\n \t$tag{'id'} = $tag_id;\n \twhile (my $line = <$fd>) {\n \t\tchomp $line;\n@@ -516,7 +512,7 @@ sub git_read_commit {\n \t\t@commit_lines = @$commit_text;\n \t} else {\n \t\t$/ = \"\\0\";\n-\t\topen my $fd, \"-|\", \"$gitbin/git-rev-list --header --parents --max-count=1 $commit_id\" or return;\n+\t\topen my $fd, \"-|\", \"$GIT rev-list --header --parents --max-count=1 $commit_id\" or return;\n \t\t@commit_lines = split '\\n', <$fd>;\n \t\tclose $fd or return;\n \t\t$/ = \"\\n\";\n@@ -614,7 +610,7 @@ sub git_diff_print {\n \tif (defined $from) {\n \t\t$from_tmp = \"$git_temp/gitweb_\" . $$ . \"_from\";\n \t\topen my $fd2, \"> $from_tmp\";\n-\t\topen my $fd, \"-|\", \"$gitbin/git-cat-file blob $from\";\n+\t\topen my $fd, \"-|\", \"$GIT cat-file blob $from\";\n \t\tmy @file = <$fd>;\n \t\tprint $fd2 @file;\n \t\tclose $fd2;\n@@ -625,7 +621,7 @@ sub git_diff_print {\n \tif (defined $to) {\n \t\t$to_tmp = \"$git_temp/gitweb_\" . $$ . \"_to\";\n \t\topen my $fd2, \"> $to_tmp\";\n-\t\topen my $fd, \"-|\", \"$gitbin/git-cat-file blob $to\";\n+\t\topen my $fd, \"-|\", \"$GIT cat-file blob $to\";\n \t\tmy @file = <$fd>;\n \t\tprint $fd2 @file;\n \t\tclose $fd2;\n@@ -844,7 +840,7 @@ sub git_get_project_config {\n \t$key =~ s/^gitweb\\.//;\n \treturn if ($key =~ m/\\W/);\n \n-\tmy $val = qx($gitbin/git-repo-config --get gitweb.$key);\n+\tmy $val = qx($GIT repo-config --get gitweb.$key);\n \treturn ($val);\n }\n \n@@ -1066,7 +1062,7 @@ sub git_summary {\n \t      \"<tr><td>owner</td><td>$owner</td></tr>\\n\" .\n \t      \"<tr><td>last change</td><td>$cd{'rfc2822'}</td></tr>\\n\" .\n \t      \"</table>\\n\";\n-\topen my $fd, \"-|\", \"$gitbin/git-rev-list --max-count=17 \" . git_read_head($project) or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT rev-list --max-count=17 \" . git_read_head($project) or die_error(undef, \"Open failed.\");\n \tmy (@revlist) = map { chomp; $_ } <$fd>;\n \tclose $fd;\n \tprint \"<div>\\n\" .\n@@ -1254,7 +1250,7 @@ sub git_blame {\n \t\t$hash = git_get_hash_by_path($hash_base, $file_name, \"blob\")\n \t\t\tor die_error(undef, \"Error lookup file.\");\n \t}\n-\topen ($fd, \"-|\", \"$gitbin/git-annotate\", '-l', '-t', '-r', $file_name, $hash_base)\n+\topen ($fd, \"-|\", $GIT, \"annotate\", '-l', '-t', '-r', $file_name, $hash_base)\n \t\tor die_error(undef, \"Open failed.\");\n \tgit_header_html();\n \tprint \"<div class=\\\"page_nav\\\">\\n\" .\n@@ -1449,7 +1445,7 @@ sub git_get_hash_by_path {\n \tmy $tree = $base;\n \tmy @parts = split '/', $path;\n \twhile (my $part = shift @parts) {\n-\t\topen my $fd, \"-|\", \"$gitbin/git-ls-tree $tree\" or die_error(undef, \"Open git-ls-tree failed.\");\n+\t\topen my $fd, \"-|\", \"$GIT ls-tree $tree\" or die_error(undef, \"Open git-ls-tree failed.\");\n \t\tmy (@entries) = map { chomp; $_ } <$fd>;\n \t\tclose $fd or return undef;\n \t\tforeach my $line (@entries) {\n@@ -1536,7 +1532,7 @@ sub git_blob_plain_mimetype {\n \n sub git_blob_plain {\n \tmy $type = shift;\n-\topen my $fd, \"-|\", \"$gitbin/git-cat-file blob $hash\" or die_error(\"Couldn't cat $file_name, $hash\");\n+\topen my $fd, \"-|\", \"$GIT cat-file blob $hash\" or die_error(\"Couldn't cat $file_name, $hash\");\n \n \t$type ||= git_blob_plain_mimetype($fd, $file_name);\n \n@@ -1563,7 +1559,7 @@ sub git_blob {\n \t\t$hash = git_get_hash_by_path($base, $file_name, \"blob\") || die_error(undef, \"Error lookup file.\");\n \t}\n \tmy $have_blame = git_get_project_config_bool ('blame');\n-\topen my $fd, \"-|\", \"$gitbin/git-cat-file blob $hash\" or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT cat-file blob $hash\" or die_error(undef, \"Open failed.\");\n \tmy $mimetype = git_blob_plain_mimetype($fd, $file_name);\n \tif ($mimetype !~ m/^text\\//) {\n \t\tclose $fd;\n@@ -1629,7 +1625,7 @@ sub git_tree {\n \t\t}\n \t}\n \t$/ = \"\\0\";\n-\topen my $fd, \"-|\", \"$gitbin/git-ls-tree -z $hash\" or die_error(undef, \"Open git-ls-tree failed.\");\n+\topen my $fd, \"-|\", \"$GIT ls-tree -z $hash\" or die_error(undef, \"Open git-ls-tree failed.\");\n \tchomp (my (@entries) = <$fd>);\n \tclose $fd or die_error(undef, \"Reading tree failed.\");\n \t$/ = \"\\n\";\n@@ -1712,7 +1708,7 @@ #\t\t\t      \" | \" . $cgi->a({-href => \"$my\n \n sub git_rss {\n \t# http://www.notestips.com/80256B3A007F2692/1/NAMO5P9UPQ\n-\topen my $fd, \"-|\", \"$gitbin/git-rev-list --max-count=150 \" . git_read_head($project) or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT rev-list --max-count=150 \" . git_read_head($project) or die_error(undef, \"Open failed.\");\n \tmy (@revlist) = map { chomp; $_ } <$fd>;\n \tclose $fd or die_error(undef, \"Reading rev-list failed.\");\n \tprint $cgi->header(-type => 'text/xml', -charset => 'utf-8');\n@@ -1732,7 +1728,7 @@ sub git_rss {\n \t\t\tlast;\n \t\t}\n \t\tmy %cd = date_str($co{'committer_epoch'});\n-\t\topen $fd, \"-|\", \"$gitbin/git-diff-tree -r $co{'parent'} $co{'id'}\" or next;\n+\t\topen $fd, \"-|\", \"$GIT diff-tree -r $co{'parent'} $co{'id'}\" or next;\n \t\tmy @difftree = map { chomp; $_ } <$fd>;\n \t\tclose $fd or next;\n \t\tprint \"<item>\\n\" .\n@@ -1820,7 +1816,7 @@ sub git_log {\n \t      \" | \" . $cgi->a({-href => \"$my_uri?\" . esc_param(\"p=$project;a=tree;h=$hash;hb=$hash\")}, \"tree\") . \"<br/>\\n\";\n \n \tmy $limit = sprintf(\"--max-count=%i\", (100 * ($page+1)));\n-\topen my $fd, \"-|\", \"$gitbin/git-rev-list $limit $hash\" or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT rev-list $limit $hash\" or die_error(undef, \"Open failed.\");\n \tmy (@revlist) = map { chomp; $_ } <$fd>;\n \tclose $fd;\n \n@@ -1911,7 +1907,7 @@ sub git_commit {\n \t\t$root = \" --root\";\n \t\t$parent = \"\";\n \t}\n-\topen my $fd, \"-|\", \"$gitbin/git-diff-tree -r -M $root $parent $hash\" or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT diff-tree -r -M $root $parent $hash\" or die_error(undef, \"Open failed.\");\n \t@difftree = map { chomp; $_ } <$fd>;\n \tclose $fd or die_error(undef, \"Reading diff-tree failed.\");\n \n@@ -2153,7 +2149,7 @@ sub git_commitdiff {\n \tif (!defined $hash_parent) {\n \t\t$hash_parent = $co{'parent'};\n \t}\n-\topen my $fd, \"-|\", \"$gitbin/git-diff-tree -r $hash_parent $hash\" or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT diff-tree -r $hash_parent $hash\" or die_error(undef, \"Open failed.\");\n \tmy (@difftree) = map { chomp; $_ } <$fd>;\n \tclose $fd or die_error(undef, \"Reading diff-tree failed.\");\n \n@@ -2243,14 +2239,14 @@ sub git_commitdiff {\n \n sub git_commitdiff_plain {\n \tmkdir($git_temp, 0700);\n-\topen my $fd, \"-|\", \"$gitbin/git-diff-tree -r $hash_parent $hash\" or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT diff-tree -r $hash_parent $hash\" or die_error(undef, \"Open failed.\");\n \tmy (@difftree) = map { chomp; $_ } <$fd>;\n \tclose $fd or die_error(undef, \"Reading diff-tree failed.\");\n \n \t# try to figure out the next tag after this commit\n \tmy $tagname;\n \tmy $refs = read_info_ref(\"tags\");\n-\topen $fd, \"-|\", \"$gitbin/git-rev-list HEAD\";\n+\topen $fd, \"-|\", \"$GIT rev-list HEAD\";\n \tchomp (my (@commits) = <$fd>);\n \tclose $fd;\n \tforeach my $commit (@commits) {\n@@ -2321,7 +2317,7 @@ sub git_history {\n \tprint \"<div class=\\\"page_path\\\"><b>/\" . esc_html($file_name) . \"</b><br/></div>\\n\";\n \n \topen my $fd, \"-|\",\n-\t\t\"$gitbin/git-rev-list --full-history $hash -- \\'$file_name\\'\";\n+\t\t\"$GIT rev-list --full-history $hash -- \\'$file_name\\'\";\n \tprint \"<table cellspacing=\\\"0\\\">\\n\";\n \tmy $alternate = 0;\n \twhile (my $line = <$fd>) {\n@@ -2408,7 +2404,7 @@ sub git_search {\n \tmy $alternate = 0;\n \tif ($commit_search) {\n \t\t$/ = \"\\0\";\n-\t\topen my $fd, \"-|\", \"$gitbin/git-rev-list --header --parents $hash\" or next;\n+\t\topen my $fd, \"-|\", \"$GIT rev-list --header --parents $hash\" or next;\n \t\twhile (my $commit_text = <$fd>) {\n \t\t\tif (!grep m/$searchtext/i, $commit_text) {\n \t\t\t\tnext;\n@@ -2458,7 +2454,7 @@ sub git_search {\n \n \tif ($pickaxe_search) {\n \t\t$/ = \"\\n\";\n-\t\topen my $fd, \"-|\", \"$gitbin/git-rev-list $hash | $gitbin/git-diff-tree -r --stdin -S\\'$searchtext\\'\";\n+\t\topen my $fd, \"-|\", \"$GIT rev-list $hash | $GIT diff-tree -r --stdin -S\\'$searchtext\\'\";\n \t\tundef %co;\n \t\tmy @files;\n \t\twhile (my $line = <$fd>) {\n@@ -2529,7 +2525,7 @@ sub git_shortlog {\n \t      \" | \" . $cgi->a({-href => \"$my_uri?\" . esc_param(\"p=$project;a=tree;h=$hash;hb=$hash\")}, \"tree\") . \"<br/>\\n\";\n \n \tmy $limit = sprintf(\"--max-count=%i\", (100 * ($page+1)));\n-\topen my $fd, \"-|\", \"$gitbin/git-rev-list $limit $hash\" or die_error(undef, \"Open failed.\");\n+\topen my $fd, \"-|\", \"$GIT rev-list $limit $hash\" or die_error(undef, \"Open failed.\");\n \tmy (@revlist) = map { chomp; $_ } <$fd>;\n \tclose $fd;\n \n-- \n1.4.1.g2fca1\n"}]}