Fossil SCM
During sync, only respond to uvgimme cards if the user has read permissions. All other paths to /uv content require that permission. Reported by Dan Mestas.
Commit
54efccf708821bbcf71c092a0632d4f814cc774067e9e6480eb935338166cc8b
Parent
2343135ec968847…
1 file changed
+3
-1
+3
-1
| --- src/xfer.c | ||
| +++ src/xfer.c | ||
| @@ -1433,11 +1433,13 @@ | ||
| 1433 | 1433 | */ |
| 1434 | 1434 | if( blob_eq(&xfer.aToken[0], "uvgimme") |
| 1435 | 1435 | && xfer.nToken==2 |
| 1436 | 1436 | && blob_is_filename(&xfer.aToken[1]) |
| 1437 | 1437 | ){ |
| 1438 | - send_unversioned_file(&xfer, blob_str(&xfer.aToken[1]), 0); | |
| 1438 | + if( g.perm.Read ){ | |
| 1439 | + send_unversioned_file(&xfer, blob_str(&xfer.aToken[1]), 0); | |
| 1440 | + } | |
| 1439 | 1441 | }else |
| 1440 | 1442 | |
| 1441 | 1443 | /* igot HASH ?ISPRIVATE? |
| 1442 | 1444 | ** |
| 1443 | 1445 | ** Client announces that it has a particular file. If the ISPRIVATE |
| 1444 | 1446 |
| --- src/xfer.c | |
| +++ src/xfer.c | |
| @@ -1433,11 +1433,13 @@ | |
| 1433 | */ |
| 1434 | if( blob_eq(&xfer.aToken[0], "uvgimme") |
| 1435 | && xfer.nToken==2 |
| 1436 | && blob_is_filename(&xfer.aToken[1]) |
| 1437 | ){ |
| 1438 | send_unversioned_file(&xfer, blob_str(&xfer.aToken[1]), 0); |
| 1439 | }else |
| 1440 | |
| 1441 | /* igot HASH ?ISPRIVATE? |
| 1442 | ** |
| 1443 | ** Client announces that it has a particular file. If the ISPRIVATE |
| 1444 |
| --- src/xfer.c | |
| +++ src/xfer.c | |
| @@ -1433,11 +1433,13 @@ | |
| 1433 | */ |
| 1434 | if( blob_eq(&xfer.aToken[0], "uvgimme") |
| 1435 | && xfer.nToken==2 |
| 1436 | && blob_is_filename(&xfer.aToken[1]) |
| 1437 | ){ |
| 1438 | if( g.perm.Read ){ |
| 1439 | send_unversioned_file(&xfer, blob_str(&xfer.aToken[1]), 0); |
| 1440 | } |
| 1441 | }else |
| 1442 | |
| 1443 | /* igot HASH ?ISPRIVATE? |
| 1444 | ** |
| 1445 | ** Client announces that it has a particular file. If the ISPRIVATE |
| 1446 |