From: Ping Yin <pkufranky@gmail.com>
Date: Fri, 18 Apr 2008 01:41:34 GMT
Subject: Re: Intricacies of submodules
Message-ID: <46dff0320804171841n7124525akeed0c680089770f1@mail.gmail.com>
In-Reply-To: <46a038f90804171431q51215be8od41792293712ca9@mail.gmail.com>

On Fri, Apr 18, 2008 at 5:31 AM, Martin Langhoff
<martin.langhoff@gmail.com> wrote:
> On Thu, Apr 17, 2008 at 6:27 PM, Sverre Rabbelier <alturin@gmail.com> wrote:
>  >  >  >  Because of that an in-tree '.gitconfig' would have no security risks
>  >  >  >  as long as it is not 'used' until after the clone.
>  >  >
>  >  >  This is not true. A pre-commit hook or pre-checkout hook could be destructive.
>  >
>  >  But, those won't be executed till after the review, so everything
>  >  would be good still, wouldn't it?
>
>  No. A local review can be quite "active", involving changing branches,
>  moving patches around, and fixing sh*t up. The hooks available offer
>  plenty of danger if the repo can set them and make them active:
>
>  $ ls .git/hooks/
>  applypatch-msg  post-commit   post-update     pre-commit  update
>  commit-msg      post-receive  pre-applypatch  pre-rebase
>
AFAIK, hooks are not cloned automatically. So where do the destructive
hooks come from?

-- 
Ping Yin