Fossil SCM
Update the documentation on the "fossil http" and "fossil server" commands to talk about restrictions on filenames and to describe how static content files can be returned.
Commit
99ab9fb47cfb20106564012b7678ca5d579060af
Parent
c71e096800109b9…
1 file changed
+17
-2
+17
-2
| --- src/main.c | ||
| +++ src/main.c | ||
| @@ -1701,10 +1701,16 @@ | ||
| 1701 | 1701 | ** If REPOSITORY is a directory that contains one or more repositories |
| 1702 | 1702 | ** with names of the form "*.fossil" then the first element of the URL |
| 1703 | 1703 | ** pathname selects among the various repositories. If the pathname does |
| 1704 | 1704 | ** not select a valid repository and the --notfound option is available, |
| 1705 | 1705 | ** then the server redirects (HTTP code 302) to the URL of --notfound. |
| 1706 | +** When REPOSITORY is a directory, the pathname must contain only | |
| 1707 | +** alphanumerics, "_", "/", "-" and "." and no "-" may occur after a "/" | |
| 1708 | +** and every "." must be surrounded on both sides by alphanumerics or else | |
| 1709 | +** a 404 error is returned. Static content files in the directory are | |
| 1710 | +** returned if they have a well-known suffix. Repository files and their | |
| 1711 | +** journals are never returned as static content. | |
| 1706 | 1712 | ** |
| 1707 | 1713 | ** The --host option can be used to specify the hostname for the server. |
| 1708 | 1714 | ** The --https option indicates that the request came from HTTPS rather |
| 1709 | 1715 | ** than HTTP. If --nossl is given, then SSL connections will not be available, |
| 1710 | 1716 | ** thus also no redirecting from http: to https: will take place. |
| @@ -1822,23 +1828,32 @@ | ||
| 1822 | 1828 | ** only process HTTP traffic from the local machine. |
| 1823 | 1829 | ** |
| 1824 | 1830 | ** In the "server" command, the REPOSITORY can be a directory (aka folder) |
| 1825 | 1831 | ** that contains one or more repositories with names ending in ".fossil". |
| 1826 | 1832 | ** In that case, the first element of the URL is used to select among the |
| 1827 | -** various repositories. | |
| 1833 | +** various repositories. To thwart mischief, the pathname in the URL must | |
| 1834 | +** contain only alphanumerics, "_", "/", "-", and ".", and no "-" may | |
| 1835 | +** occur after "/", and every "." must be surrounded on both sides by | |
| 1836 | +** alphanumerics. Any pathname that does not satisfy these constraints | |
| 1837 | +** results in a 404 error. Files in REPOSITORY that have known suffixes | |
| 1838 | +** such as ".txt" or ".html" or ".jpeg" (but not ".fossil"!) will be | |
| 1839 | +** served as static content. | |
| 1828 | 1840 | ** |
| 1829 | 1841 | ** By default, the "ui" command provides full administrative access without |
| 1830 | 1842 | ** having to log in. This can be disabled by setting turning off the |
| 1831 | 1843 | ** "localauth" setting. Automatic login for the "server" command is available |
| 1832 | 1844 | ** if the --localauth option is present and the "localauth" setting is off |
| 1833 | -** and the connection is from localhost. | |
| 1845 | +** and the connection is from localhost. The optional REPOSITORY argument | |
| 1846 | +** to "ui" may be a directory and will function as "server" if and only if | |
| 1847 | +** the --notfound option is used. | |
| 1834 | 1848 | ** |
| 1835 | 1849 | ** Options: |
| 1836 | 1850 | ** --localauth enable automatic login for requests from localhost |
| 1837 | 1851 | ** -P|--port TCPPORT listen to request on port TCPPORT |
| 1838 | 1852 | ** --th-trace trace TH1 execution (for debugging purposes) |
| 1839 | 1853 | ** --baseurl URL Use URL as the base (useful for reverse proxies) |
| 1854 | +** --notfound URL Redirect | |
| 1840 | 1855 | ** |
| 1841 | 1856 | ** See also: cgi, http, winsrv |
| 1842 | 1857 | */ |
| 1843 | 1858 | void cmd_webserver(void){ |
| 1844 | 1859 | int iPort, mxPort; /* Range of TCP ports allowed */ |
| 1845 | 1860 |
| --- src/main.c | |
| +++ src/main.c | |
| @@ -1701,10 +1701,16 @@ | |
| 1701 | ** If REPOSITORY is a directory that contains one or more repositories |
| 1702 | ** with names of the form "*.fossil" then the first element of the URL |
| 1703 | ** pathname selects among the various repositories. If the pathname does |
| 1704 | ** not select a valid repository and the --notfound option is available, |
| 1705 | ** then the server redirects (HTTP code 302) to the URL of --notfound. |
| 1706 | ** |
| 1707 | ** The --host option can be used to specify the hostname for the server. |
| 1708 | ** The --https option indicates that the request came from HTTPS rather |
| 1709 | ** than HTTP. If --nossl is given, then SSL connections will not be available, |
| 1710 | ** thus also no redirecting from http: to https: will take place. |
| @@ -1822,23 +1828,32 @@ | |
| 1822 | ** only process HTTP traffic from the local machine. |
| 1823 | ** |
| 1824 | ** In the "server" command, the REPOSITORY can be a directory (aka folder) |
| 1825 | ** that contains one or more repositories with names ending in ".fossil". |
| 1826 | ** In that case, the first element of the URL is used to select among the |
| 1827 | ** various repositories. |
| 1828 | ** |
| 1829 | ** By default, the "ui" command provides full administrative access without |
| 1830 | ** having to log in. This can be disabled by setting turning off the |
| 1831 | ** "localauth" setting. Automatic login for the "server" command is available |
| 1832 | ** if the --localauth option is present and the "localauth" setting is off |
| 1833 | ** and the connection is from localhost. |
| 1834 | ** |
| 1835 | ** Options: |
| 1836 | ** --localauth enable automatic login for requests from localhost |
| 1837 | ** -P|--port TCPPORT listen to request on port TCPPORT |
| 1838 | ** --th-trace trace TH1 execution (for debugging purposes) |
| 1839 | ** --baseurl URL Use URL as the base (useful for reverse proxies) |
| 1840 | ** |
| 1841 | ** See also: cgi, http, winsrv |
| 1842 | */ |
| 1843 | void cmd_webserver(void){ |
| 1844 | int iPort, mxPort; /* Range of TCP ports allowed */ |
| 1845 |
| --- src/main.c | |
| +++ src/main.c | |
| @@ -1701,10 +1701,16 @@ | |
| 1701 | ** If REPOSITORY is a directory that contains one or more repositories |
| 1702 | ** with names of the form "*.fossil" then the first element of the URL |
| 1703 | ** pathname selects among the various repositories. If the pathname does |
| 1704 | ** not select a valid repository and the --notfound option is available, |
| 1705 | ** then the server redirects (HTTP code 302) to the URL of --notfound. |
| 1706 | ** When REPOSITORY is a directory, the pathname must contain only |
| 1707 | ** alphanumerics, "_", "/", "-" and "." and no "-" may occur after a "/" |
| 1708 | ** and every "." must be surrounded on both sides by alphanumerics or else |
| 1709 | ** a 404 error is returned. Static content files in the directory are |
| 1710 | ** returned if they have a well-known suffix. Repository files and their |
| 1711 | ** journals are never returned as static content. |
| 1712 | ** |
| 1713 | ** The --host option can be used to specify the hostname for the server. |
| 1714 | ** The --https option indicates that the request came from HTTPS rather |
| 1715 | ** than HTTP. If --nossl is given, then SSL connections will not be available, |
| 1716 | ** thus also no redirecting from http: to https: will take place. |
| @@ -1822,23 +1828,32 @@ | |
| 1828 | ** only process HTTP traffic from the local machine. |
| 1829 | ** |
| 1830 | ** In the "server" command, the REPOSITORY can be a directory (aka folder) |
| 1831 | ** that contains one or more repositories with names ending in ".fossil". |
| 1832 | ** In that case, the first element of the URL is used to select among the |
| 1833 | ** various repositories. To thwart mischief, the pathname in the URL must |
| 1834 | ** contain only alphanumerics, "_", "/", "-", and ".", and no "-" may |
| 1835 | ** occur after "/", and every "." must be surrounded on both sides by |
| 1836 | ** alphanumerics. Any pathname that does not satisfy these constraints |
| 1837 | ** results in a 404 error. Files in REPOSITORY that have known suffixes |
| 1838 | ** such as ".txt" or ".html" or ".jpeg" (but not ".fossil"!) will be |
| 1839 | ** served as static content. |
| 1840 | ** |
| 1841 | ** By default, the "ui" command provides full administrative access without |
| 1842 | ** having to log in. This can be disabled by setting turning off the |
| 1843 | ** "localauth" setting. Automatic login for the "server" command is available |
| 1844 | ** if the --localauth option is present and the "localauth" setting is off |
| 1845 | ** and the connection is from localhost. The optional REPOSITORY argument |
| 1846 | ** to "ui" may be a directory and will function as "server" if and only if |
| 1847 | ** the --notfound option is used. |
| 1848 | ** |
| 1849 | ** Options: |
| 1850 | ** --localauth enable automatic login for requests from localhost |
| 1851 | ** -P|--port TCPPORT listen to request on port TCPPORT |
| 1852 | ** --th-trace trace TH1 execution (for debugging purposes) |
| 1853 | ** --baseurl URL Use URL as the base (useful for reverse proxies) |
| 1854 | ** --notfound URL Redirect |
| 1855 | ** |
| 1856 | ** See also: cgi, http, winsrv |
| 1857 | */ |
| 1858 | void cmd_webserver(void){ |
| 1859 | int iPort, mxPort; /* Range of TCP ports allowed */ |
| 1860 |