home/gitolite
2
0
Fork 0
mirror of https://github.com/wahyd4/gitolite.git synced 2026-08-21 10:55:57 +10:00
Code Issues Packages Projects Releases Wiki Activity

security fix for optional ADC (admin-defined command) feature

Browse Source 
Thanks to Dylan Simon for catching it...
This commit is contained in:
Sitaram Chamarty
2011-02-15 14:58:42 +05:30
parent 9b5793f2d1
commit 4ce00aef84
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/gl-auth-command
+1
View File
@@ -154,6 +154,7 @@ die "server is in slave mode; you can only fetch\n"
if ($GL_ADC_PATH and -d $GL_ADC_PATH) {
my ($cmd, @args) = split ' ', $ENV{SSH_ORIGINAL_COMMAND};
if (-x "$GL_ADC_PATH/$cmd") {
die "I don't like $cmd\n" if $cmd =~ /\.\./;
# yes this is rather strict, sorry.
do { die "I don't like $_\n" unless $_ =~ $ADC_CMD_ARGS_PATT } for ($cmd, @args);
&log_it("$GL_ADC_PATH/$ENV{SSH_ORIGINAL_COMMAND}");