Fossil SCM

Fix the URL parser so that it only has access to the CONFIG table entries for URL aliases if the URL_USE_CONFIG flag is set in the second parameter.

drh 2021-12-23 14:09 trunk

Commit 0aff8d8744c613114b8268e8e3a60643191be83192935e5337907a26caf24a50

Parent f0cdbd8b95f5b8e…

4 files changed +3 -3 +33 -25 +2 -2 +1 -1

~ src/sync.c ~ src/url.c ~ src/user.c ~ src/xfersetup.c

M src/sync.c

+3 -3

		--- src/sync.c
		+++ src/sync.c
		@@ -72,11 +72,11 @@
72	72	}
73	73	db_finalize(&q);
74	74	for(i=0; i<nOther; i++){
75	75	int rc;
76	76	url_unparse(&g.url);
77		- url_parse(azOther[i], URL_PROMPT_PW\|URL_ASK_REMEMBER_PW);
	77	+ url_parse(azOther[i], URL_PROMPT_PW\|URL_ASK_REMEMBER_PW\|URL_USE_CONFIG);
78	78	sync_explain(syncFlags);
79	79	rc = client_sync(syncFlags, configRcvMask, configSendMask, zAltPCode);
80	80	nErr += rc;
81	81	if( (g.url.flags & URL_REMEMBER_PW)!=0 && rc==0 ){
82	82	char *zKey = mprintf("sync-pw:%s", azOther[i]);
		@@ -129,11 +129,11 @@
129	129	){
130	130	flags &= ~SYNC_CKIN_LOCK;
131	131	if( flags & SYNC_PUSH ) return 0;
132	132	}
133	133	if( find_option("verbose","v",0)!=0 ) flags \|= SYNC_VERBOSE;
134		- url_parse(0, URL_REMEMBER);
	134	+ url_parse(0, URL_REMEMBER\|URL_USE_CONFIG);
135	135	if( g.url.protocol==0 ) return 0;
136	136	if( g.url.user!=0 && g.url.passwd==0 ){
137	137	g.url.passwd = unobscure(db_get("last-sync-pw", 0));
138	138	g.url.flags \|= URL_PROMPT_PW;
139	139	url_prompt_for_password();
		@@ -279,11 +279,11 @@
279	279	}
280	280	urlFlags &= ~urlOmitFlags;
281	281	if( urlFlags & URL_REMEMBER ){
282	282	clone_ssh_db_set_options();
283	283	}
284		- url_parse(zUrl, urlFlags);
	284	+ url_parse(zUrl, urlFlags\|URL_USE_CONFIG);
285	285	remember_or_get_http_auth(zHttpAuth, urlFlags & URL_REMEMBER, zUrl);
286	286	if( g.url.protocol==0 ){
287	287	if( urlOptional ) fossil_exit(0);
288	288	usage("URL");
289	289	}
290	290

	--- src/sync.c
	+++ src/sync.c
	@@ -72,11 +72,11 @@
72	}
73	db_finalize(&q);
74	for(i=0; i<nOther; i++){
75	int rc;
76	url_unparse(&g.url);
77	url_parse(azOther[i], URL_PROMPT_PW\|URL_ASK_REMEMBER_PW);
78	sync_explain(syncFlags);
79	rc = client_sync(syncFlags, configRcvMask, configSendMask, zAltPCode);
80	nErr += rc;
81	if( (g.url.flags & URL_REMEMBER_PW)!=0 && rc==0 ){
82	char *zKey = mprintf("sync-pw:%s", azOther[i]);
	@@ -129,11 +129,11 @@
129	){
130	flags &= ~SYNC_CKIN_LOCK;
131	if( flags & SYNC_PUSH ) return 0;
132	}
133	if( find_option("verbose","v",0)!=0 ) flags \|= SYNC_VERBOSE;
134	url_parse(0, URL_REMEMBER);
135	if( g.url.protocol==0 ) return 0;
136	if( g.url.user!=0 && g.url.passwd==0 ){
137	g.url.passwd = unobscure(db_get("last-sync-pw", 0));
138	g.url.flags \|= URL_PROMPT_PW;
139	url_prompt_for_password();
	@@ -279,11 +279,11 @@
279	}
280	urlFlags &= ~urlOmitFlags;
281	if( urlFlags & URL_REMEMBER ){
282	clone_ssh_db_set_options();
283	}
284	url_parse(zUrl, urlFlags);
285	remember_or_get_http_auth(zHttpAuth, urlFlags & URL_REMEMBER, zUrl);
286	if( g.url.protocol==0 ){
287	if( urlOptional ) fossil_exit(0);
288	usage("URL");
289	}
290

	--- src/sync.c
	+++ src/sync.c
	@@ -72,11 +72,11 @@
72	}
73	db_finalize(&q);
74	for(i=0; i<nOther; i++){
75	int rc;
76	url_unparse(&g.url);
77	url_parse(azOther[i], URL_PROMPT_PW\|URL_ASK_REMEMBER_PW\|URL_USE_CONFIG);
78	sync_explain(syncFlags);
79	rc = client_sync(syncFlags, configRcvMask, configSendMask, zAltPCode);
80	nErr += rc;
81	if( (g.url.flags & URL_REMEMBER_PW)!=0 && rc==0 ){
82	char *zKey = mprintf("sync-pw:%s", azOther[i]);
	@@ -129,11 +129,11 @@
129	){
130	flags &= ~SYNC_CKIN_LOCK;
131	if( flags & SYNC_PUSH ) return 0;
132	}
133	if( find_option("verbose","v",0)!=0 ) flags \|= SYNC_VERBOSE;
134	url_parse(0, URL_REMEMBER\|URL_USE_CONFIG);
135	if( g.url.protocol==0 ) return 0;
136	if( g.url.user!=0 && g.url.passwd==0 ){
137	g.url.passwd = unobscure(db_get("last-sync-pw", 0));
138	g.url.flags \|= URL_PROMPT_PW;
139	url_prompt_for_password();
	@@ -279,11 +279,11 @@
279	}
280	urlFlags &= ~urlOmitFlags;
281	if( urlFlags & URL_REMEMBER ){
282	clone_ssh_db_set_options();
283	}
284	url_parse(zUrl, urlFlags\|URL_USE_CONFIG);
285	remember_or_get_http_auth(zHttpAuth, urlFlags & URL_REMEMBER, zUrl);
286	if( g.url.protocol==0 ){
287	if( urlOptional ) fossil_exit(0);
288	usage("URL");
289	}
290

M src/url.c

+33 -25

		--- src/url.c
		+++ src/url.c
		@@ -39,10 +39,11 @@
39	39	#define URL_REMEMBER 0x002 /* Remember the url for later reuse */
40	40	#define URL_ASK_REMEMBER_PW 0x004 /* Ask whether to remember prompted pw */
41	41	#define URL_REMEMBER_PW 0x008 /* Should remember pw */
42	42	#define URL_PROMPTED 0x010 /* Prompted for PW already */
43	43	#define URL_OMIT_USER 0x020 /* Omit the user name from URL */
	44	+#define URL_USE_CONFIG 0x040 /* Use remembered URLs from CONFIG table */
44	45
45	46	/*
46	47	** The URL related data used with this subsystem.
47	48	*/
48	49	struct UrlData {
		@@ -68,14 +69,12 @@
68	69	};
69	70	#endif /* INTERFACE */
70	71
71	72
72	73	/*
73		-** Parse the given URL. Or if zUrl is NULL, parse the URL in the
74		-** last-sync-url setting using last-sync-pw as the password. Store
75		-** the parser results in the pUrlData object. Populate members of pUrlData
76		-** as follows:
	74	+** Parse the URL in the zUrl argument. Store results in the pUrlData object.
	75	+** Populate members of pUrlData as follows:
77	76	**
78	77	** isFile True if FILE:
79	78	** isHttps True if HTTPS:
80	79	** isSsh True if SSH:
81	80	** protocol "http" or "https" or "file" or "ssh"
		@@ -86,10 +85,15 @@
86	85	** user Userid.
87	86	** passwd Password.
88	87	** hostname HOST:PORT or just HOST if port is the default.
89	88	** canonical The URL in canonical form, omitting the password
90	89	**
	90	+** If zUrl==0, then parse the URL store in last-sync-url and last-sync-pw
	91	+** of the CONFIG table. Or if zUrl is a symbolic name, look up the URL
	92	+** in sync-url:%Q and sync-pw:%Q elements of the CONFIG table. But only
	93	+** use the CONFIG table alternatives if the URL_FROM_CONFIG flag is set.
	94	+**
91	95	** This routine differs from url_parse() in that this routine stores the
92	96	** results in pUrlData and does not change the values of global variables.
93	97	** The url_parse() routine puts its result in g.url.
94	98	*/
95	99	void url_parse_local(
		@@ -98,31 +102,35 @@
98	102	UrlData *pUrlData
99	103	){
100	104	int i, j, c;
101	105	char *zFile = 0;
102	106
103		- if( zUrl==0 \|\| strcmp(zUrl,"default")==0 ){
104		- zUrl = db_get("last-sync-url", 0);
105		- if( zUrl==0 ) return;
106		- if( pUrlData->passwd==0 ){
107		- pUrlData->passwd = unobscure(db_get("last-sync-pw", 0));
108		- }
109		- pUrlData->isAlias = 1;
110		- }else{
111		- char *zKey = sqlite3_mprintf("sync-url:%q", zUrl);
112		- char *zAlt = db_get(zKey, 0);
113		- sqlite3_free(zKey);
114		- if( zAlt ){
115		- pUrlData->passwd = unobscure(
116		- db_text(0, "SELECT value FROM config WHERE name='sync-pw:%q'",zUrl)
117		- );
118		- zUrl = zAlt;
119		- urlFlags \|= URL_REMEMBER_PW;
120		- pUrlData->isAlias = 1;
121		- }else{
122		- pUrlData->isAlias = 0;
123		- }
	107	+ if( urlFlags & URL_USE_CONFIG ){
	108	+ if( zUrl==0 \|\| strcmp(zUrl,"default")==0 ){
	109	+ zUrl = db_get("last-sync-url", 0);
	110	+ if( zUrl==0 ) return;
	111	+ if( pUrlData->passwd==0 ){
	112	+ pUrlData->passwd = unobscure(db_get("last-sync-pw", 0));
	113	+ }
	114	+ pUrlData->isAlias = 1;
	115	+ }else{
	116	+ char *zKey = sqlite3_mprintf("sync-url:%q", zUrl);
	117	+ char *zAlt = db_get(zKey, 0);
	118	+ sqlite3_free(zKey);
	119	+ if( zAlt ){
	120	+ pUrlData->passwd = unobscure(
	121	+ db_text(0, "SELECT value FROM config WHERE name='sync-pw:%q'",zUrl)
	122	+ );
	123	+ zUrl = zAlt;
	124	+ urlFlags \|= URL_REMEMBER_PW;
	125	+ pUrlData->isAlias = 1;
	126	+ }else{
	127	+ pUrlData->isAlias = 0;
	128	+ }
	129	+ }
	130	+ }else{
	131	+ if( zUrl==0 ) return;
124	132	}
125	133
126	134	if( strncmp(zUrl, "http://", 7)==0
127	135	\|\| strncmp(zUrl, "https://", 8)==0
128	136	\|\| strncmp(zUrl, "ssh://", 6)==0
129	137

	--- src/url.c
	+++ src/url.c
	@@ -39,10 +39,11 @@
39	#define URL_REMEMBER 0x002 /* Remember the url for later reuse */
40	#define URL_ASK_REMEMBER_PW 0x004 /* Ask whether to remember prompted pw */
41	#define URL_REMEMBER_PW 0x008 /* Should remember pw */
42	#define URL_PROMPTED 0x010 /* Prompted for PW already */
43	#define URL_OMIT_USER 0x020 /* Omit the user name from URL */

44
45	/*
46	** The URL related data used with this subsystem.
47	*/
48	struct UrlData {
	@@ -68,14 +69,12 @@
68	};
69	#endif /* INTERFACE */
70
71
72	/*
73	** Parse the given URL. Or if zUrl is NULL, parse the URL in the
74	** last-sync-url setting using last-sync-pw as the password. Store
75	** the parser results in the pUrlData object. Populate members of pUrlData
76	** as follows:
77	**
78	** isFile True if FILE:
79	** isHttps True if HTTPS:
80	** isSsh True if SSH:
81	** protocol "http" or "https" or "file" or "ssh"
	@@ -86,10 +85,15 @@
86	** user Userid.
87	** passwd Password.
88	** hostname HOST:PORT or just HOST if port is the default.
89	** canonical The URL in canonical form, omitting the password
90	**





91	** This routine differs from url_parse() in that this routine stores the
92	** results in pUrlData and does not change the values of global variables.
93	** The url_parse() routine puts its result in g.url.
94	*/
95	void url_parse_local(
	@@ -98,31 +102,35 @@
98	UrlData *pUrlData
99	){
100	int i, j, c;
101	char *zFile = 0;
102
103	if( zUrl==0 \|\| strcmp(zUrl,"default")==0 ){
104	zUrl = db_get("last-sync-url", 0);
105	if( zUrl==0 ) return;
106	if( pUrlData->passwd==0 ){
107	pUrlData->passwd = unobscure(db_get("last-sync-pw", 0));
108	}
109	pUrlData->isAlias = 1;
110	}else{
111	char *zKey = sqlite3_mprintf("sync-url:%q", zUrl);
112	char *zAlt = db_get(zKey, 0);
113	sqlite3_free(zKey);
114	if( zAlt ){
115	pUrlData->passwd = unobscure(
116	db_text(0, "SELECT value FROM config WHERE name='sync-pw:%q'",zUrl)
117	);
118	zUrl = zAlt;
119	urlFlags \|= URL_REMEMBER_PW;
120	pUrlData->isAlias = 1;
121	}else{
122	pUrlData->isAlias = 0;
123	}




124	}
125
126	if( strncmp(zUrl, "http://", 7)==0
127	\|\| strncmp(zUrl, "https://", 8)==0
128	\|\| strncmp(zUrl, "ssh://", 6)==0
129

	--- src/url.c
	+++ src/url.c
	@@ -39,10 +39,11 @@
39	#define URL_REMEMBER 0x002 /* Remember the url for later reuse */
40	#define URL_ASK_REMEMBER_PW 0x004 /* Ask whether to remember prompted pw */
41	#define URL_REMEMBER_PW 0x008 /* Should remember pw */
42	#define URL_PROMPTED 0x010 /* Prompted for PW already */
43	#define URL_OMIT_USER 0x020 /* Omit the user name from URL */
44	#define URL_USE_CONFIG 0x040 /* Use remembered URLs from CONFIG table */
45
46	/*
47	** The URL related data used with this subsystem.
48	*/
49	struct UrlData {
	@@ -68,14 +69,12 @@
69	};
70	#endif /* INTERFACE */
71
72
73	/*
74	** Parse the URL in the zUrl argument. Store results in the pUrlData object.
75	** Populate members of pUrlData as follows:


76	**
77	** isFile True if FILE:
78	** isHttps True if HTTPS:
79	** isSsh True if SSH:
80	** protocol "http" or "https" or "file" or "ssh"
	@@ -86,10 +85,15 @@
85	** user Userid.
86	** passwd Password.
87	** hostname HOST:PORT or just HOST if port is the default.
88	** canonical The URL in canonical form, omitting the password
89	**
90	** If zUrl==0, then parse the URL store in last-sync-url and last-sync-pw
91	** of the CONFIG table. Or if zUrl is a symbolic name, look up the URL
92	** in sync-url:%Q and sync-pw:%Q elements of the CONFIG table. But only
93	** use the CONFIG table alternatives if the URL_FROM_CONFIG flag is set.
94	**
95	** This routine differs from url_parse() in that this routine stores the
96	** results in pUrlData and does not change the values of global variables.
97	** The url_parse() routine puts its result in g.url.
98	*/
99	void url_parse_local(
	@@ -98,31 +102,35 @@
102	UrlData *pUrlData
103	){
104	int i, j, c;
105	char *zFile = 0;
106
107	if( urlFlags & URL_USE_CONFIG ){
108	if( zUrl==0 \|\| strcmp(zUrl,"default")==0 ){
109	zUrl = db_get("last-sync-url", 0);
110	if( zUrl==0 ) return;
111	if( pUrlData->passwd==0 ){
112	pUrlData->passwd = unobscure(db_get("last-sync-pw", 0));
113	}
114	pUrlData->isAlias = 1;
115	}else{
116	char *zKey = sqlite3_mprintf("sync-url:%q", zUrl);
117	char *zAlt = db_get(zKey, 0);
118	sqlite3_free(zKey);
119	if( zAlt ){
120	pUrlData->passwd = unobscure(
121	db_text(0, "SELECT value FROM config WHERE name='sync-pw:%q'",zUrl)
122	);
123	zUrl = zAlt;
124	urlFlags \|= URL_REMEMBER_PW;
125	pUrlData->isAlias = 1;
126	}else{
127	pUrlData->isAlias = 0;
128	}
129	}
130	}else{
131	if( zUrl==0 ) return;
132	}
133
134	if( strncmp(zUrl, "http://", 7)==0
135	\|\| strncmp(zUrl, "https://", 8)==0
136	\|\| strncmp(zUrl, "ssh://", 6)==0
137

M src/user.c

+2 -2

		--- src/user.c
		+++ src/user.c
		@@ -536,11 +536,11 @@
536	536	if( attempt_user(fossil_getenv("LOGNAME")) ) return;
537	537
538	538	if( attempt_user(fossil_getenv("USERNAME")) ) return;
539	539
540	540	memset(&url, 0, sizeof(url));
541		- url_parse_local(0, 0, &url);
	541	+ url_parse_local(0, URL_USE_CONFIG, &url);
542	542	if( url.user && attempt_user(url.user) ) return;
543	543
544	544	fossil_print(
545	545	"Cannot figure out who you are! Consider using the --user\n"
546	546	"command line option, setting your USER environment variable,\n"
		@@ -566,11 +566,11 @@
566	566	fossil_print("default-user: %s\n", db_get("default-user",""));
567	567	fossil_print("FOSSIL_USER: %s\n", fossil_getenv("FOSSIL_USER"));
568	568	fossil_print("USER: %s\n", fossil_getenv("USER"));
569	569	fossil_print("LOGNAME: %s\n", fossil_getenv("LOGNAME"));
570	570	fossil_print("USERNAME: %s\n", fossil_getenv("USERNAME"));
571		- url_parse(0, 0);
	571	+ url_parse(0, URL_USE_CONFIG);
572	572	fossil_print("URL user: %s\n", g.url.user);
573	573	user_select();
574	574	fossil_print("Final g.zLogin: %s\n", g.zLogin);
575	575	fossil_print("Final g.userUid: %d\n", g.userUid);
576	576	}
577	577

	--- src/user.c
	+++ src/user.c
	@@ -536,11 +536,11 @@
536	if( attempt_user(fossil_getenv("LOGNAME")) ) return;
537
538	if( attempt_user(fossil_getenv("USERNAME")) ) return;
539
540	memset(&url, 0, sizeof(url));
541	url_parse_local(0, 0, &url);
542	if( url.user && attempt_user(url.user) ) return;
543
544	fossil_print(
545	"Cannot figure out who you are! Consider using the --user\n"
546	"command line option, setting your USER environment variable,\n"
	@@ -566,11 +566,11 @@
566	fossil_print("default-user: %s\n", db_get("default-user",""));
567	fossil_print("FOSSIL_USER: %s\n", fossil_getenv("FOSSIL_USER"));
568	fossil_print("USER: %s\n", fossil_getenv("USER"));
569	fossil_print("LOGNAME: %s\n", fossil_getenv("LOGNAME"));
570	fossil_print("USERNAME: %s\n", fossil_getenv("USERNAME"));
571	url_parse(0, 0);
572	fossil_print("URL user: %s\n", g.url.user);
573	user_select();
574	fossil_print("Final g.zLogin: %s\n", g.zLogin);
575	fossil_print("Final g.userUid: %d\n", g.userUid);
576	}
577

	--- src/user.c
	+++ src/user.c
	@@ -536,11 +536,11 @@
536	if( attempt_user(fossil_getenv("LOGNAME")) ) return;
537
538	if( attempt_user(fossil_getenv("USERNAME")) ) return;
539
540	memset(&url, 0, sizeof(url));
541	url_parse_local(0, URL_USE_CONFIG, &url);
542	if( url.user && attempt_user(url.user) ) return;
543
544	fossil_print(
545	"Cannot figure out who you are! Consider using the --user\n"
546	"command line option, setting your USER environment variable,\n"
	@@ -566,11 +566,11 @@
566	fossil_print("default-user: %s\n", db_get("default-user",""));
567	fossil_print("FOSSIL_USER: %s\n", fossil_getenv("FOSSIL_USER"));
568	fossil_print("USER: %s\n", fossil_getenv("USER"));
569	fossil_print("LOGNAME: %s\n", fossil_getenv("LOGNAME"));
570	fossil_print("USERNAME: %s\n", fossil_getenv("USERNAME"));
571	url_parse(0, URL_USE_CONFIG);
572	fossil_print("URL user: %s\n", g.url.user);
573	user_select();
574	fossil_print("Final g.zLogin: %s\n", g.zLogin);
575	fossil_print("Final g.userUid: %d\n", g.userUid);
576	}
577

M src/xfersetup.c

+1 -1

		--- src/xfersetup.c
		+++ src/xfersetup.c
		@@ -44,11 +44,11 @@
44	44	"Specific TH1 code to run after processing a commit.");
45	45	setup_menu_entry("Ticket", "xfersetup_ticket",
46	46	"Specific TH1 code to run after processing a ticket change.");
47	47	@ </table>
48	48
49		- url_parse(0, 0);
	49	+ url_parse(0, URL_USE_CONFIG);
50	50	if( g.url.protocol ){
51	51	unsigned syncFlags;
52	52	const char *zButton;
53	53	char *zWarning;
54	54
55	55

	--- src/xfersetup.c
	+++ src/xfersetup.c
	@@ -44,11 +44,11 @@
44	"Specific TH1 code to run after processing a commit.");
45	setup_menu_entry("Ticket", "xfersetup_ticket",
46	"Specific TH1 code to run after processing a ticket change.");
47	@ </table>
48
49	url_parse(0, 0);
50	if( g.url.protocol ){
51	unsigned syncFlags;
52	const char *zButton;
53	char *zWarning;
54
55

	--- src/xfersetup.c
	+++ src/xfersetup.c
	@@ -44,11 +44,11 @@
44	"Specific TH1 code to run after processing a commit.");
45	setup_menu_entry("Ticket", "xfersetup_ticket",
46	"Specific TH1 code to run after processing a ticket change.");
47	@ </table>
48
49	url_parse(0, URL_USE_CONFIG);
50	if( g.url.protocol ){
51	unsigned syncFlags;
52	const char *zButton;
53	char *zWarning;
54
55

Fossil SCM

Keyboard Shortcuts