From dfaf1fc1f6d8214bcabb9a613d53d0f0dc45352c Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Sun, 07 Sep 2014 11:43:33 -0400
Subject: [PATCH] XSS sanitize standard page url parameters
---
src/main/java/com/gitblit/manager/GitblitManager.java | 33 +++++++++++++++++++++++++++++++++
1 files changed, 33 insertions(+), 0 deletions(-)
diff --git a/src/main/java/com/gitblit/manager/GitblitManager.java b/src/main/java/com/gitblit/manager/GitblitManager.java
index 16c71ba..2ed52d6 100644
--- a/src/main/java/com/gitblit/manager/GitblitManager.java
+++ b/src/main/java/com/gitblit/manager/GitblitManager.java
@@ -79,6 +79,7 @@
import com.gitblit.transport.ssh.IPublicKeyManager;
import com.gitblit.transport.ssh.SshKey;
import com.gitblit.utils.ArrayUtils;
+import com.gitblit.utils.XssFilter;
import com.gitblit.utils.HttpUtils;
import com.gitblit.utils.JsonUtils;
import com.gitblit.utils.ObjectCache;
@@ -216,6 +217,13 @@
RepositoryModel cloneModel = repository.cloneAs(cloneName);
// owner has REWIND/RW+ permissions
cloneModel.addOwner(user.username);
+
+ // ensure initial access restriction of the fork
+ // is not lower than the source repository (issue-495/ticket-167)
+ if (repository.accessRestriction.exceeds(cloneModel.accessRestriction)) {
+ cloneModel.accessRestriction = repository.accessRestriction;
+ }
+
repositoryManager.updateRepositoryModel(cloneName, cloneModel, false);
// add the owner of the source repository to the clone's access list
@@ -602,6 +610,21 @@
}
@Override
+ public boolean isServingHTTP() {
+ return runtimeManager.isServingHTTP();
+ }
+
+ @Override
+ public boolean isServingGIT() {
+ return runtimeManager.isServingGIT();
+ }
+
+ @Override
+ public boolean isServingSSH() {
+ return runtimeManager.isServingSSH();
+ }
+
+ @Override
public TimeZone getTimezone() {
return runtimeManager.getTimezone();
}
@@ -641,11 +664,21 @@
return runtimeManager.getStatus();
}
+ @Override
+ public XssFilter getXssFilter() {
+ return runtimeManager.getXssFilter();
+ }
+
/*
* NOTIFICATION MANAGER
*/
@Override
+ public boolean isSendingMail() {
+ return notificationManager.isSendingMail();
+ }
+
+ @Override
public void sendMailToAdministrators(String subject, String message) {
notificationManager.sendMailToAdministrators(subject, message);
}
--
Gitblit v1.9.1