diff options
| author | Jason A. Donenfeld <[email protected]> | 2018-08-03 13:46:11 +0000 |
|---|---|---|
| committer | Jason A. Donenfeld <[email protected]> | 2018-08-03 15:04:03 +0000 |
| commit | 53efaf30b50f095cad8c160488c74bba3e3b2680 (patch) | |
| tree | 48c0be88bfef03400ddd4b3871baf9de9dbe0b77 /ui-tag.c | |
| parent | config: record repo.snapshot-prefix in the per-repo config (diff) | |
| download | cgit-53efaf30b50f095cad8c160488c74bba3e3b2680.tar.gz cgit-53efaf30b50f095cad8c160488c74bba3e3b2680.zip | |
clone: fix directory traversal
This was introduced in the initial version of this code, way back when
in 2008.
$ curl http://127.0.0.1/cgit/repo/objects/?path=../../../../../../../../../etc/passwd
root:x:0:0:root:/root:/bin/sh
...
Signed-off-by: Jason A. Donenfeld <[email protected]>
Reported-by: Jann Horn <[email protected]>
Diffstat (limited to 'ui-tag.c')
0 files changed, 0 insertions, 0 deletions