Re: [PATCH 3/3] daemon: Support a --user-path option.
Junio C Hamano <junkio@cox.net> writes:
> Wouldn't loosening the "request must be absolute if you use
> --base-path" check in the area your first patch in the series
> touches to also allow paths that start with a '~' be enough?
That is, something like this is what I mean.
Tested, of course ;-).
diff --git a/daemon.c b/daemon.c
index 532bb0c..324bb04 100644
--- a/daemon.c
+++ b/daemon.c
@@ -145,13 +145,17 @@ static char *path_ok(char *dir)
if (base_path) {
static char rpath[PATH_MAX];
- if (*dir != '/') {
- /* Forbid possible base-path evasion using ~paths. */
+ if (!strict_paths && *dir == '~')
+ ; /* allow user relative paths */
+ else if (*dir != '/') {
+ /* otherwise allow only absolute */
logerror("'%s': Non-absolute path denied (base-path active)", dir);
return NULL;
}
- snprintf(rpath, PATH_MAX, "%s%s", base_path, dir);
- dir = rpath;
+ else {
+ snprintf(rpath, PATH_MAX, "%s%s", base_path, dir);
+ dir = rpath;
+ }
}
path = enter_repo(dir, strict_paths);
Junio C Hamano <junkio@cox.net>