Sebastian Sdorra
8aaa67cd6a
#970 inspect mercurial commands in order to detect write requests
...
The HgPermissionFilter will now inspect the used mercurial command, of all requests which are using a read method like GET, HEAD, OPTIONS or TRACE and tread every one as write request, expect:
- no command was specified with the request (this is required for the hgweb ui)
- the command in the query string was found in the list of read commands
- if query string contains the batch command, then all commands specified in X-HgArg headers must be in the list of read commands
This change is required, in order to fix CVE-2018-1000132 for SCM-Manager.
2018-03-29 20:26:56 +02:00
Sebastian Sdorra
3a9bc6828d
use code blocks for request and response
2018-03-29 19:58:52 +02:00
Sebastian Sdorra
e7dd54c133
#970 added ngrep dumps for mercurial wire protocol and more realistic tests for isWriteRequest
2018-03-29 10:21:34 +02:00
Sebastian Sdorra
d066e59c0d
merge with branch issue-959
2018-03-09 08:34:52 +01:00
Sebastian Sdorra
d888929813
close branch issue-959
2018-03-09 08:34:24 +01:00
Sebastian Sdorra
7d94b03a04
#959 added option to disable ssl validation for scm mercurial hook
2018-02-23 08:44:22 +01:00
Sebastian Sdorra
d21a28fa0b
[maven-release-plugin] prepare for next development iteration
2018-02-09 08:14:35 +01:00
Sebastian Sdorra
c288243197
[maven-release-plugin] copy for tag 1.57
2018-02-09 08:14:34 +01:00
Sebastian Sdorra
b64d41f3c9
[maven-release-plugin] prepare release 1.57
2018-02-09 08:14:34 +01:00
Sebastian Sdorra
3206a2a4f0
merge with branch issue-965
2018-02-09 07:59:38 +01:00
Sebastian Sdorra
184b802992
close branch issue-965
2018-02-09 07:59:17 +01:00
Sebastian Sdorra
c216692eab
#965 fixed handling of resources with spaces in its id
2018-02-08 22:36:54 +01:00
Sebastian Sdorra
a8186a2492
update svnkit to version 1.9.0-scm3
2018-02-07 15:19:20 +01:00
Sebastian Sdorra
9dd25b334a
treat update of a git tag as delete and create for hooks
2018-02-07 11:24:53 +01:00
Sebastian Sdorra
0ff9b255c3
[maven-release-plugin] prepare for next development iteration
2018-01-15 14:51:11 +01:00
Sebastian Sdorra
f9a9050888
[maven-release-plugin] copy for tag 1.56
2018-01-15 14:51:11 +01:00
Sebastian Sdorra
f66221e566
[maven-release-plugin] prepare release 1.56
2018-01-15 14:51:10 +01:00
Sebastian Sdorra
9b27a9fd8a
merge with branch issue-939
2018-01-15 14:36:12 +01:00
Sebastian Sdorra
942cd5d190
close branch issue-939
2018-01-15 14:35:31 +01:00
Sebastian Sdorra
2c5cd634b3
update svnkit to v1.9.0-scm2, to fix high cpu load after client connection abort. See Issue #939
2017-12-15 12:53:12 +01:00
Sebastian Sdorra
efb9af213b
merge with branch issue-953
2017-11-20 17:01:40 +01:00
Sebastian Sdorra
1b3e76e809
close branch issue-953
2017-11-20 17:01:10 +01:00
Sebastian Sdorra
5e6685260e
fix integer overflow of request with body larger than 4gb, see issue #953
2017-11-19 21:07:28 +01:00
Sebastian Sdorra
712c14f910
[maven-release-plugin] prepare for next development iteration
2017-11-02 09:21:42 +01:00
Sebastian Sdorra
cd9e07421c
[maven-release-plugin] copy for tag 1.55
2017-11-02 09:21:42 +01:00
Sebastian Sdorra
fd047c1170
[maven-release-plugin] prepare release 1.55
2017-11-02 09:21:42 +01:00
Sebastian Sdorra
c75eb388d9
update jgit to version v4.5.3.201708160445-r-scm1
2017-10-25 15:02:28 +02:00
Sebastian Sdorra
241f41bb1c
update svnkit to version 1.9.0-scm1
2017-10-25 14:21:38 +02:00
Gábor Stefanik
77eea15417
oops... don't interpret "close=junk" as "close=1"
2017-09-18 12:34:50 +00:00
Gábor Stefanik
14ee6ef0d6
prevent binary data in {extras} from interfering with UTF-8 decoding
2017-09-18 12:30:20 +00:00
Sebastian Sdorra
f72648f646
fixes usage of named cache configurations, see issue #943
2017-08-14 16:04:30 +02:00
Sebastian Sdorra
785e1b12a9
fixed update of git repositories with empty git default branch, see issue #903
2017-07-07 19:09:46 +02:00
Sebastian Sdorra
b17a23ddc8
added option to disallow non fast-forward git pushes
2017-07-06 10:13:11 +02:00
Sebastian Sdorra
73cfbe8993
remove work directory after package upgrade, see #923
2017-06-25 13:46:39 +02:00
Sebastian Sdorra
07a1c8b151
[maven-release-plugin] prepare for next development iteration
2017-06-06 11:39:35 +02:00
Sebastian Sdorra
a7366731ba
[maven-release-plugin] copy for tag 1.54
2017-06-06 11:39:34 +02:00
Sebastian Sdorra
fd02f4c068
[maven-release-plugin] prepare release 1.54
2017-06-06 11:39:34 +02:00
Sebastian Sdorra
663b1d9248
update jetty to version 7.6.21.v20160908
2017-06-06 11:21:43 +02:00
Sebastian Sdorra
0b78c4eeeb
fix wrong itcase commit message
2017-06-06 11:21:05 +02:00
Sebastian Sdorra
2df42711dc
update jersey to version 1.19.4
2017-06-06 11:26:22 +02:00
Sebastian Sdorra
b7568ea919
introducing new ExtensionPoint for repository path matching
...
The new ExtensionPoint was introduced to remove the tight coupling between the DefaultRepositoryManager and the GitRepositoryHandler.
Git has now its own RepositoryPathMatcher which allow the matching of repository with .git or without .git extension.
2017-06-06 10:46:44 +02:00
Sebastian Sdorra
58035845ce
improve GitRepositoryResolver to allow requests to repositories which ends with .git, the resolver will automatically remove the .git extension and resolves the repository
2017-06-06 10:43:29 +02:00
Sebastian Sdorra
6eb480fe84
git repository client should return the work tree as working copy instead of .git directory
2017-06-06 10:41:36 +02:00
Sebastian Sdorra
05c2ffbecf
ignore some falsepositive sonarqube issues
2017-06-06 08:15:45 +02:00
Sebastian Sdorra
b51fba2282
fix repository browsing with mercurial 4.x
2017-06-06 08:14:04 +02:00
Sebastian Sdorra
84b15fdf89
implemented integration tests for lfs
2017-06-02 14:18:41 +02:00
Sebastian Sdorra
0677af1336
shiro-unit should be in test scope
2017-06-01 22:07:45 +02:00
Sebastian Sdorra
a59c352e2d
update jgit to v4.5.2.201704071617-r-scm1
2017-06-01 18:03:12 +02:00
Sebastian Sdorra
1effc9c29b
remove all items from lfs blob store, if the corresponding repository was removed
2017-06-01 17:28:59 +02:00
Sebastian Sdorra
2a8cfc00d8
use pattern and matcher instead of string matches, to improve performance
2017-06-01 16:27:20 +02:00
