# [PATCH] gitweb fix validating pg (page) parameter

4 messages from 2006-09-17 to 2006-09-17. Participants: Matthias Lederhofer, Junio C Hamano.
Thread: https://gitlist.dev/t/5589

## Matthias Lederhofer, 2006-09-17 11:52

Subject: [PATCH] gitweb fix validating pg (page) parameter
Message-ID: <20060917115245.GA15658@moooo.ath.cx>
URL: https://gitlist.dev/e/20060917115245.GA15658%40moooo.ath.cx

```
Currently it is possible to give any string ending with a number as
page.  -1 for example is quite bad (error log shows probably 100
warnings).
---
 gitweb/gitweb.perl |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 497129a..346c15c 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -259,7 +259,7 @@ if (defined $hash_parent_base) {
 
 our $page = $cgi->param('pg');
 if (defined $page) {
-	if ($page =~ m/[^0-9]$/) {
+	if ($page =~ m/[^0-9]/) {
 		die_error(undef, "Invalid page parameter");
 	}
 }
-- 
1.4.2.1.ge767

```

## Junio C Hamano, 2006-09-17 21:21

Subject: Re: [PATCH] gitweb fix validating pg (page) parameter
Message-ID: <7vlkoi2nqr.fsf@assigned-by-dhcp.cox.net>
URL: https://gitlist.dev/e/7vlkoi2nqr.fsf%40assigned-by-dhcp.cox.net
In-Reply-To: <20060917115245.GA15658@moooo.ath.cx>

```
Matthias Lederhofer <matled@gmx.net> writes:

> Currently it is possible to give any string ending with a number as
> page.  -1 for example is quite bad (error log shows probably 100
> warnings).
>
> @@ -259,7 +259,7 @@ if (defined $hash_parent_base) {
>  
>  our $page = $cgi->param('pg');
>  if (defined $page) {
> -	if ($page =~ m/[^0-9]$/) {
> +	if ($page =~ m/[^0-9]/) {
>  		die_error(undef, "Invalid page parameter");
>  	}
>  }

Are we complaining if $page is not a validly formatted number
here?  If so why not

	unless ($page =~ /^\d+$/ && 1 <= $page) {
        	barf(...);
	}

???

```

## Matthias Lederhofer, 2006-09-17 21:38

Subject: Re: [PATCH] gitweb fix validating pg (page) parameter
Message-ID: <20060917213838.GA12782@moooo.ath.cx>
URL: https://gitlist.dev/e/20060917213838.GA12782%40moooo.ath.cx
In-Reply-To: <7vlkoi2nqr.fsf@assigned-by-dhcp.cox.net>

```
Junio C Hamano <junkio@cox.net> wrote:
> Matthias Lederhofer <matled@gmx.net> writes:
> 
> > Currently it is possible to give any string ending with a number as
> > page.  -1 for example is quite bad (error log shows probably 100
> > warnings).
> >
> > @@ -259,7 +259,7 @@ if (defined $hash_parent_base) {
> >  
> >  our $page = $cgi->param('pg');
> >  if (defined $page) {
> > -	if ($page =~ m/[^0-9]$/) {
> > +	if ($page =~ m/[^0-9]/) {
> >  		die_error(undef, "Invalid page parameter");
> >  	}
> >  }
> 
> Are we complaining if $page is not a validly formatted number
> here?  If so why not
> 
> 	unless ($page =~ /^\d+$/ && 1 <= $page) {
>         	barf(...);
> 	}
The first page seems to have number 0.  After removing the 1 <= $page
this code should do the same as my patch, apply whatever you think is
easier to read (I prefer if over unless most of the time).

```

## Junio C Hamano, 2006-09-17 21:45

Subject: Re: [PATCH] gitweb fix validating pg (page) parameter
Message-ID: <7v8xki2mmb.fsf@assigned-by-dhcp.cox.net>
URL: https://gitlist.dev/e/7v8xki2mmb.fsf%40assigned-by-dhcp.cox.net
In-Reply-To: <20060917213838.GA12782@moooo.ath.cx>

```
Matthias Lederhofer <matled@gmx.net> writes:

>> > +	if ($page =~ m/[^0-9]/) {
>...
> The first page seems to have number 0.  After removing the 1 <= $page
> this code should do the same as my patch, apply whatever you think is
> easier to read (I prefer if over unless most of the time).

Ah, I did not notice we call the first page 0; barfing on any
non-digit in the string like you do sounds quite sane.

Thanks.

```