From: Junio C Hamano <gitster@pobox.com>
Date: Mon, 10 Sep 2012 17:37:42 GMT
Subject: Re: Confirm my false error suspicions of Gitweb query injection
Message-ID: <7vlighok2h.fsf@alter.siamese.dyndns.org>
In-Reply-To: <CAMOg_eUjmnisevN+AaArz+6TMpWYJL660xwG0ptEaTO7stcL6A@mail.gmail.com>

Joseph Leong <josephcleong@gmail.com> writes:

> Hi Everyone,
>
> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).
>
> I was poking around and tried a GET Request (REQ) with some SQL
> statements as a search query and noticed a 500. Can i just confirm
> with anyone here that the error message I'm seeing in the Response
> (RESP) is basically saying that the search parameters are invalid
> because of it's funny chars are breaking the regex search and that
> it's not anything database related.

Yes, I think this was fixed in v1.7.9.4 if not earlier, with e65ceb6
(gitweb: Fix fixed string (non-regexp) project search, 2012-03-02).