From: Joseph Leong <josephcleong@gmail.com>
Date: Mon, 10 Sep 2012 17:41:35 GMT
Subject: Re: Confirm my false error suspicions of Gitweb query injection
Message-ID: <CAMOg_eUVm08jQSNR1F1iU3Och-Lk07p=vWpkuUz7iZWpi4cEfg@mail.gmail.com>
In-Reply-To: <7vlighok2h.fsf@alter.siamese.dyndns.org>

and you earned bonus points for the details - thank you very much!


On Mon, Sep 10, 2012 at 10:37 AM, Junio C Hamano <gitster@pobox.com> wrote:
> Joseph Leong <josephcleong@gmail.com> writes:
>
>> Hi Everyone,
>>
>> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).
>>
>> I was poking around and tried a GET Request (REQ) with some SQL
>> statements as a search query and noticed a 500. Can i just confirm
>> with anyone here that the error message I'm seeing in the Response
>> (RESP) is basically saying that the search parameters are invalid
>> because of it's funny chars are breaking the regex search and that
>> it's not anything database related.
>
> Yes, I think this was fixed in v1.7.9.4 if not earlier, with e65ceb6
> (gitweb: Fix fixed string (non-regexp) project search, 2012-03-02).
>