From: Ilari Liusvaara <ilari.liusvaara@elisanet.fi>
Date: Fri, 15 Jan 2010 11:52:12 GMT
Subject: Re: Removal of post-upload-hook
Message-ID: <20100115115212.GA9221@Knoppix>
In-Reply-To: <6f8b45101001142212i4151c625k54b450cd5978f158@mail.gmail.com>

On Fri, Jan 15, 2010 at 11:42:19AM +0530, Arun Raghavan wrote:
> 
> Another thought - would it be acceptable to have a config option to
> enable/disable these types of hooks, so that people who are not
> affected by the problem or explicitly don't care can use them? Perhaps
> a core.allowInsecureHooks ?

That enable/disable would have to ignore per-repo configuration, which
would make it behave differently from other options. Otherwise attacker
could just flip the setting...

-Ilari