From: Jeff King <peff@peff.net>
Date: Thu, 14 Jan 2010 20:43:05 GMT
Subject: Re: Removal of post-upload-hook
Message-ID: <20100114204305.GC26883@coredump.intra.peff.net>
In-Reply-To: <20100114194107.GA20033@spearce.org>

On Thu, Jan 14, 2010 at 11:41:07AM -0800, Shawn O. Pearce wrote:

> > Because receive-pack runs as the user who is pushing, not as the
> > repository owner. So by convincing you to push to my repository in a
> > multi-user environment, I convince you to run some arbitrary code of
> > mine.
> 
> Uhhh, this was in fetch/upload-pack Peff, not push/receive-pack.
> 
> Same issue though.

Errr...yeah. Sorry for the confusion. But yes, it's the same mechanism,
except that it is even easier to get people to pull from you (to get
them to push, you first have to get them to write a worthwhile code
contribution. ;) ).

-Peff