Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | New Zip permission. This permission allow someone to download a
zipped artifact via the wiki's /zip URL. It can given the user
nobody to allow automatic package builder to download the sources
they know from fossil-scm.org or other servers without any
intervening login necessary.
As the /zip page do not expose anything, a spider should have a hard time to crawl thru the project using this URL. So IMO it does not open a break-in hole for spiders. |
|---|---|
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA1: |
fa6e9930177e84ce089b30ad768c454a |
| User & Date: | cle 2008-08-12 03:27:54.000 |
References
|
2011-09-11
| ||
| 14:08 | • Fixed ticket [164e519962]: .zip archive of an artifact should be available w/o a login plus 2 other changes artifact: 9fcd4791fe user: dmitry | |
Context
|
2008-08-13
| ||
| 11:57 |
Allow an alternative URL syntax for downloading artifacts via the /zip page.
The original way is:
http://localhost:8080/zip/fa6e9930177e84ce089b30ad768c454a012364f7.zipwhich will store the artifact in the file a6e9930177e84ce089b30ad768c454a012364f7.zip. Alternatively it is now possible to download the ar... check-in: 417dd898ab user: hintze tags: trunk | |
|
2008-08-12
| ||
| 03:27 |
New Zip permission. This permission allow someone to download a
zipped artifact via the wiki's /zip URL. It can given the user
nobody to allow automatic package builder to download the sources
they know from fossil-scm.org or other servers without any
intervening login necessary.
As the /zip page do not e... check-in: fa6e993017 user: cle tags: trunk | |
|
2008-08-11
| ||
| 05:30 | Fix a spelling: replace 'delete' -> 'cancel' in usage for 'tag'. check-in: 91ec6982e9 user: hintze tags: trunk | |
Changes
Changes to src/login.c.
| ︙ | ︙ | |||
326 327 328 329 330 331 332 333 334 335 336 337 338 339 |
case 'a': g.okAdmin = g.okRdTkt = g.okWrTkt =
g.okRdWiki = g.okWrWiki = g.okNewWiki =
g.okApndWiki = g.okHistory = g.okClone =
g.okNewTkt = g.okPassword = g.okRdAddr =
g.okTktFmt = 1;
case 'i': g.okRead = g.okWrite = 1; break;
case 'o': g.okRead = 1; break;
case 'd': g.okDelete = 1; break;
case 'h': g.okHistory = 1; break;
case 'g': g.okClone = 1; break;
case 'p': g.okPassword = 1; break;
case 'j': g.okRdWiki = 1; break;
| > | 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 |
case 'a': g.okAdmin = g.okRdTkt = g.okWrTkt =
g.okRdWiki = g.okWrWiki = g.okNewWiki =
g.okApndWiki = g.okHistory = g.okClone =
g.okNewTkt = g.okPassword = g.okRdAddr =
g.okTktFmt = 1;
case 'i': g.okRead = g.okWrite = 1; break;
case 'o': g.okRead = 1; break;
case 'z': g.okZip = 1; break;
case 'd': g.okDelete = 1; break;
case 'h': g.okHistory = 1; break;
case 'g': g.okClone = 1; break;
case 'p': g.okPassword = 1; break;
case 'j': g.okRdWiki = 1; break;
|
| ︙ | ︙ |
Changes to src/main.c.
| ︙ | ︙ | |||
115 116 117 118 119 120 121 122 123 124 125 126 127 128 | int okWrWiki; /* k: edit wiki via web */ int okRdTkt; /* r: view tickets via web */ int okNewTkt; /* n: create new tickets */ int okApndTkt; /* c: append to tickets via the web */ int okWrTkt; /* w: make changes to tickets via web */ int okTktFmt; /* t: create new ticket report formats */ int okRdAddr; /* e: read email addresses or other private data */ FILE *fDebug; /* Write debug information here, if the file exists */ /* Storage for the aux() and/or option() SQL function arguments */ int nAux; /* Number of distinct aux() or option() values */ const char *azAuxName[MX_AUX]; /* Name of each aux() or option() value */ char *azAuxParam[MX_AUX]; /* Param of each aux() or option() value */ | > | 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 | int okWrWiki; /* k: edit wiki via web */ int okRdTkt; /* r: view tickets via web */ int okNewTkt; /* n: create new tickets */ int okApndTkt; /* c: append to tickets via the web */ int okWrTkt; /* w: make changes to tickets via web */ int okTktFmt; /* t: create new ticket report formats */ int okRdAddr; /* e: read email addresses or other private data */ int okZip; /* z: download zipped artifact via /zip URL */ FILE *fDebug; /* Write debug information here, if the file exists */ /* Storage for the aux() and/or option() SQL function arguments */ int nAux; /* Number of distinct aux() or option() values */ const char *azAuxName[MX_AUX]; /* Name of each aux() or option() value */ char *azAuxParam[MX_AUX]; /* Param of each aux() or option() value */ |
| ︙ | ︙ |
Changes to src/setup.c.
| ︙ | ︙ | |||
152 153 154 155 156 157 158 159 160 161 162 163 164 165 | @ <li value="15"><b>Check-Out</b>: Check out versions</li> @ <li value="16"><b>Password</b>: Change your own password</li> @ <li value="18"><b>Read-Tkt</b>: View tickets</li> @ <li value="19"><b>Setup:</b> Setup and configure this website</li> @ <li value="20"><b>Tkt-Report:</b> Create new bug summary reports</li> @ <li value="22"><b>Developer:</b> Inherit privileges of user "developer"</li> @ <li value="23"><b>Write-Tkt</b>: Edit tickets</li> @ </ol> @ </p></li> @ @ <li><p> @ Every user, logged in or not, inherits the privileges of <b>nobody</b>. @ Any human can login as <b>anonymous</b> since the password is @ clearly displayed on the login page for them to type. The purpose | > | 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 | @ <li value="15"><b>Check-Out</b>: Check out versions</li> @ <li value="16"><b>Password</b>: Change your own password</li> @ <li value="18"><b>Read-Tkt</b>: View tickets</li> @ <li value="19"><b>Setup:</b> Setup and configure this website</li> @ <li value="20"><b>Tkt-Report:</b> Create new bug summary reports</li> @ <li value="22"><b>Developer:</b> Inherit privileges of user "developer"</li> @ <li value="23"><b>Write-Tkt</b>: Edit tickets</li> @ <li value="26"><b>Zip</b>: Download zipped artifacts</li> @ </ol> @ </p></li> @ @ <li><p> @ Every user, logged in or not, inherits the privileges of <b>nobody</b>. @ Any human can login as <b>anonymous</b> since the password is @ clearly displayed on the login page for them to type. The purpose |
| ︙ | ︙ | |||
189 190 191 192 193 194 195 |
/*
** WEBPAGE: /setup_uedit
*/
void user_edit(void){
const char *zId, *zLogin, *zInfo, *zCap, *zPw;
char *oaa, *oas, *oar, *oaw, *oan, *oai, *oaj, *oao, *oap;
char *oak, *oad, *oac, *oaf, *oam, *oah, *oag, *oae;
| | | 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 |
/*
** WEBPAGE: /setup_uedit
*/
void user_edit(void){
const char *zId, *zLogin, *zInfo, *zCap, *zPw;
char *oaa, *oas, *oar, *oaw, *oan, *oai, *oaj, *oao, *oap;
char *oak, *oad, *oac, *oaf, *oam, *oah, *oag, *oae;
char *oat, *oav, *oaz;
int doWrite;
int uid;
int higherUser = 0; /* True if user being edited is SETUP and the */
/* user doing the editing is ADMIN. Disallow editing */
/* Must have ADMIN privleges to access this page
*/
|
| ︙ | ︙ | |||
243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 |
int ac = P("ac")!=0;
int af = P("af")!=0;
int am = P("am")!=0;
int ah = P("ah")!=0;
int ag = P("ag")!=0;
int at = P("at")!=0;
int av = P("av")!=0;
if( aa ){ zCap[i++] = 'a'; }
if( ac ){ zCap[i++] = 'c'; }
if( ad ){ zCap[i++] = 'd'; }
if( ae ){ zCap[i++] = 'e'; }
if( af ){ zCap[i++] = 'f'; }
if( ah ){ zCap[i++] = 'h'; }
if( ag ){ zCap[i++] = 'g'; }
if( ai ){ zCap[i++] = 'i'; }
if( aj ){ zCap[i++] = 'j'; }
if( ak ){ zCap[i++] = 'k'; }
if( am ){ zCap[i++] = 'm'; }
if( an ){ zCap[i++] = 'n'; }
if( ao ){ zCap[i++] = 'o'; }
if( ap ){ zCap[i++] = 'p'; }
if( ar ){ zCap[i++] = 'r'; }
if( as ){ zCap[i++] = 's'; }
if( at ){ zCap[i++] = 't'; }
if( av ){ zCap[i++] = 'v'; }
if( aw ){ zCap[i++] = 'w'; }
zCap[i] = 0;
zPw = P("pw");
if( !isValidPwString(zPw) ){
zPw = db_text(0, "SELECT pw FROM user WHERE uid=%d", uid);
}
zLogin = P("login");
| > > | 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 |
int ac = P("ac")!=0;
int af = P("af")!=0;
int am = P("am")!=0;
int ah = P("ah")!=0;
int ag = P("ag")!=0;
int at = P("at")!=0;
int av = P("av")!=0;
int az = P("az")!=0;
if( aa ){ zCap[i++] = 'a'; }
if( ac ){ zCap[i++] = 'c'; }
if( ad ){ zCap[i++] = 'd'; }
if( ae ){ zCap[i++] = 'e'; }
if( af ){ zCap[i++] = 'f'; }
if( ah ){ zCap[i++] = 'h'; }
if( ag ){ zCap[i++] = 'g'; }
if( ai ){ zCap[i++] = 'i'; }
if( aj ){ zCap[i++] = 'j'; }
if( ak ){ zCap[i++] = 'k'; }
if( am ){ zCap[i++] = 'm'; }
if( an ){ zCap[i++] = 'n'; }
if( ao ){ zCap[i++] = 'o'; }
if( ap ){ zCap[i++] = 'p'; }
if( ar ){ zCap[i++] = 'r'; }
if( as ){ zCap[i++] = 's'; }
if( at ){ zCap[i++] = 't'; }
if( av ){ zCap[i++] = 'v'; }
if( aw ){ zCap[i++] = 'w'; }
if( az ){ zCap[i++] = 'z'; }
zCap[i] = 0;
zPw = P("pw");
if( !isValidPwString(zPw) ){
zPw = db_text(0, "SELECT pw FROM user WHERE uid=%d", uid);
}
zLogin = P("login");
|
| ︙ | ︙ | |||
296 297 298 299 300 301 302 | /* Load the existing information about the user, if any */ zLogin = ""; zInfo = ""; zCap = ""; zPw = ""; oaa = oac = oad = oae = oaf = oag = oah = oai = oaj = oak = oam = | | | 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 |
/* Load the existing information about the user, if any
*/
zLogin = "";
zInfo = "";
zCap = "";
zPw = "";
oaa = oac = oad = oae = oaf = oag = oah = oai = oaj = oak = oam =
oan = oao = oap = oar = oas = oat = oav = oaw = oaz = "";
if( uid ){
zLogin = db_text("", "SELECT login FROM user WHERE uid=%d", uid);
zInfo = db_text("", "SELECT info FROM user WHERE uid=%d", uid);
zCap = db_text("", "SELECT cap FROM user WHERE uid=%d", uid);
zPw = db_text("", "SELECT pw FROM user WHERE uid=%d", uid);
if( strchr(zCap, 'a') ) oaa = " checked";
if( strchr(zCap, 'c') ) oac = " checked";
|
| ︙ | ︙ | |||
321 322 323 324 325 326 327 328 329 330 331 332 333 334 |
if( strchr(zCap, 'o') ) oao = " checked";
if( strchr(zCap, 'p') ) oap = " checked";
if( strchr(zCap, 'r') ) oar = " checked";
if( strchr(zCap, 's') ) oas = " checked";
if( strchr(zCap, 't') ) oat = " checked";
if( strchr(zCap, 'v') ) oav = " checked";
if( strchr(zCap, 'w') ) oaw = " checked";
}
/* Begin generating the page
*/
style_submenu_element("Cancel", "Cancel", "setup_ulist");
if( uid ){
style_header(mprintf("Edit User %h", zLogin));
| > | 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 |
if( strchr(zCap, 'o') ) oao = " checked";
if( strchr(zCap, 'p') ) oap = " checked";
if( strchr(zCap, 'r') ) oar = " checked";
if( strchr(zCap, 's') ) oas = " checked";
if( strchr(zCap, 't') ) oat = " checked";
if( strchr(zCap, 'v') ) oav = " checked";
if( strchr(zCap, 'w') ) oaw = " checked";
if( strchr(zCap, 'z') ) oaz = " checked";
}
/* Begin generating the page
*/
style_submenu_element("Cancel", "Cancel", "setup_ulist");
if( uid ){
style_header(mprintf("Edit User %h", zLogin));
|
| ︙ | ︙ | |||
373 374 375 376 377 378 379 | @ <input type="checkbox" name="af"%s(oaf)>New Wiki</input><br> @ <input type="checkbox" name="am"%s(oam)>Append Wiki</input><br> @ <input type="checkbox" name="ak"%s(oak)>Write Wiki</input><br> @ <input type="checkbox" name="ar"%s(oar)>Read Tkt</input><br> @ <input type="checkbox" name="an"%s(oan)>New Tkt</input><br> @ <input type="checkbox" name="ac"%s(oac)>Append Tkt</input><br> @ <input type="checkbox" name="aw"%s(oaw)>Write Tkt</input><br> | | > | 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 |
@ <input type="checkbox" name="af"%s(oaf)>New Wiki</input><br>
@ <input type="checkbox" name="am"%s(oam)>Append Wiki</input><br>
@ <input type="checkbox" name="ak"%s(oak)>Write Wiki</input><br>
@ <input type="checkbox" name="ar"%s(oar)>Read Tkt</input><br>
@ <input type="checkbox" name="an"%s(oan)>New Tkt</input><br>
@ <input type="checkbox" name="ac"%s(oac)>Append Tkt</input><br>
@ <input type="checkbox" name="aw"%s(oaw)>Write Tkt</input><br>
@ <input type="checkbox" name="at"%s(oat)>Tkt Report</input><br>
@ <input type="checkbox" name="az"%s(oaz)>Download Zip</input>
@ </td>
@ </tr>
@ <tr>
@ <td align="right">Password:</td>
if( strcmp(zLogin, "anonymous")==0 ){
/* User the password for "anonymous" as cleartext */
@ <td><input type="text" name="pw" value="%h(zPw)"></td>
|
| ︙ | ︙ | |||
428 429 430 431 432 433 434 435 436 437 438 439 440 441 | @ <li><p> @ The <b>History</b> privilege allows a user to see most hyperlinks. @ This is recommended ON for most logged-in users but OFF for @ user "nobody" to avoid problems with spiders trying to walk every @ historical version of every baseline and file. @ </p></li> @ @ <li><p> @ The <b>Developer</b> privilege causes all privileges of the user @ named "developer" to be inherited by this user. @ </p></li> @ @ <li><p> @ The <b>Check-in</b> privilege allows remote users to "push". | > > > > > > > > > | 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 | @ <li><p> @ The <b>History</b> privilege allows a user to see most hyperlinks. @ This is recommended ON for most logged-in users but OFF for @ user "nobody" to avoid problems with spiders trying to walk every @ historical version of every baseline and file. @ </p></li> @ @ <li><p> @ The <b>Zip</b> privilege allows a user to see the download as zip hyperlink @ as well as permit access to the <tt>/zip</tt> page. It can be allowed for @ user "nobody" to grant him access to download artifacts he know from the @ server without giving him other rights like <b>Read</b> or <b>History</b>. @ So automatic package dowloaders could be able to obtain the sources without @ going thru the login procedure. @ </p></li> @ @ <li><p> @ The <b>Developer</b> privilege causes all privileges of the user @ named "developer" to be inherited by this user. @ </p></li> @ @ <li><p> @ The <b>Check-in</b> privilege allows remote users to "push". |
| ︙ | ︙ |
Changes to src/zip.c.
| ︙ | ︙ | |||
354 355 356 357 358 359 360 |
void baseline_zip_page(void){
int rid;
char *zName;
int nName;
Blob zip;
login_check_credentials();
| | | 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 |
void baseline_zip_page(void){
int rid;
char *zName;
int nName;
Blob zip;
login_check_credentials();
if( !g.okZip && (!g.okRead || !g.okHistory) ){ login_needed(); return; }
zName = mprintf("%s", PD("name",""));
nName = strlen(zName);
for(nName=strlen(zName)-1; nName>5; nName--){
if( zName[nName]=='.' ){
zName[nName] = 0;
break;
}
|
| ︙ | ︙ |