Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | The allow-symlinks setting is no longer versionable and is off by default. The allow-symlinks setting no longer propagates with a clone. The help text for allow-symlinks discourages its use. There is a new --symlink flag on "fossil open" to permit the use of symlinks on an open, for the adventurous. Ticket [f9831fdef1d4edcc]. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | sec2020 |
| Files: | files | file ages | folders |
| SHA3-256: |
ff98dd5af61aef30ca4a18c320f3850f |
| User & Date: | drh 2020-08-17 17:34:39.308 |
References
|
2020-08-17
| ||
| 19:03 | • Ticket [f9831fdef1] Arbitrary file overwrite using symlinks status still Open with 5 other changes artifact: efa1c51ead user: drh | |
Context
|
2020-08-17
| ||
| 18:20 | Merge in reject-ckout-db branch. check-in: 8c16884aa2 user: stephan tags: sec2020 | |
| 17:34 | The allow-symlinks setting is no longer versionable and is off by default. The allow-symlinks setting no longer propagates with a clone. The help text for allow-symlinks discourages its use. There is a new --symlink flag on "fossil open" to permit the use of symlinks on an open, for the adventurous. Ticket [f9831fdef1d4edcc]. check-in: ff98dd5af6 user: drh tags: sec2020 | |
| 14:09 | Set an authorizer when running the ticket-table SQL. Ticket [56b82836ffba9952]. check-in: fb41384045 user: drh tags: sec2020 | |
Changes
Changes to src/checkin.c.
| ︙ | ︙ | |||
854 855 856 857 858 859 860 |
/* We should be done with options.. */
verify_all_options();
if( zIgnoreFlag==0 ){
zIgnoreFlag = db_get("ignore-glob", 0);
}
pIgnore = glob_create(zIgnoreFlag);
| < < | 854 855 856 857 858 859 860 861 862 863 864 865 866 867 |
/* We should be done with options.. */
verify_all_options();
if( zIgnoreFlag==0 ){
zIgnoreFlag = db_get("ignore-glob", 0);
}
pIgnore = glob_create(zIgnoreFlag);
locate_unmanaged_files(g.argc-2, g.argv+2, scanFlags, pIgnore);
glob_free(pIgnore);
blob_zero(&report);
status_report(&report, flags);
if( blob_size(&report) ){
if( showHdr ){
|
| ︙ | ︙ | |||
1013 1014 1015 1016 1017 1018 1019 |
}
if( db_get_boolean("dotfiles", 0) ) scanFlags |= SCAN_ALL;
verify_all_options();
pIgnore = glob_create(zIgnoreFlag);
pKeep = glob_create(zKeepFlag);
pClean = glob_create(zCleanFlag);
nRoot = (int)strlen(g.zLocalRoot);
| < < | 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 |
}
if( db_get_boolean("dotfiles", 0) ) scanFlags |= SCAN_ALL;
verify_all_options();
pIgnore = glob_create(zIgnoreFlag);
pKeep = glob_create(zKeepFlag);
pClean = glob_create(zCleanFlag);
nRoot = (int)strlen(g.zLocalRoot);
if( !dirsOnlyFlag ){
Stmt q;
Blob repo;
if( !dryRunFlag && !disableUndo ) undo_begin();
locate_unmanaged_files(g.argc-2, g.argv+2, scanFlags, pIgnore);
db_prepare(&q,
"SELECT %Q || pathname FROM sfile"
|
| ︙ | ︙ |
Changes to src/configure.c.
| ︙ | ︙ | |||
141 142 143 144 145 146 147 |
{ "clean-glob", CONFIGSET_PROJ },
{ "ignore-glob", CONFIGSET_PROJ },
{ "keep-glob", CONFIGSET_PROJ },
{ "crlf-glob", CONFIGSET_PROJ },
{ "crnl-glob", CONFIGSET_PROJ },
{ "encoding-glob", CONFIGSET_PROJ },
{ "empty-dirs", CONFIGSET_PROJ },
| < | 141 142 143 144 145 146 147 148 149 150 151 152 153 154 |
{ "clean-glob", CONFIGSET_PROJ },
{ "ignore-glob", CONFIGSET_PROJ },
{ "keep-glob", CONFIGSET_PROJ },
{ "crlf-glob", CONFIGSET_PROJ },
{ "crnl-glob", CONFIGSET_PROJ },
{ "encoding-glob", CONFIGSET_PROJ },
{ "empty-dirs", CONFIGSET_PROJ },
{ "dotfiles", CONFIGSET_PROJ },
{ "parent-project-code", CONFIGSET_PROJ },
{ "parent-project-name", CONFIGSET_PROJ },
{ "hash-policy", CONFIGSET_PROJ },
{ "comment-format", CONFIGSET_PROJ },
{ "mimetypes", CONFIGSET_PROJ },
{ "forbid-delta-manifests", CONFIGSET_PROJ },
|
| ︙ | ︙ |
Changes to src/db.c.
| ︙ | ︙ | |||
1821 1822 1823 1824 1825 1826 1827 |
zRepo = file_canonical_name_dup(zFree);
fossil_free(zFree);
}
}
return zRepo;
}
| < < < < < < < < < < < < | 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 |
zRepo = file_canonical_name_dup(zFree);
fossil_free(zFree);
}
}
return zRepo;
}
/*
** Returns non-zero if support for symlinks is currently enabled.
*/
int db_allow_symlinks(void){
return g.allowSymlinks;
}
|
| ︙ | ︙ | |||
1878 1879 1880 1881 1882 1883 1884 1885 |
}
}
g.zRepositoryName = mprintf("%s", zDbName);
db_open_or_attach(g.zRepositoryName, "repository");
g.repositoryOpen = 1;
sqlite3_file_control(g.db, "repository", SQLITE_FCNTL_DATA_VERSION,
&g.iRepoDataVers);
/* Cache "allow-symlinks" option, because we'll need it on every stat call */
| > | | | 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 |
}
}
g.zRepositoryName = mprintf("%s", zDbName);
db_open_or_attach(g.zRepositoryName, "repository");
g.repositoryOpen = 1;
sqlite3_file_control(g.db, "repository", SQLITE_FCNTL_DATA_VERSION,
&g.iRepoDataVers);
/* Cache "allow-symlinks" option, because we'll need it on every stat call */
g.allowSymlinks = db_get_boolean("allow-symlinks",0);
g.zAuxSchema = db_get("aux-schema","");
g.eHashPolicy = db_get_int("hash-policy",-1);
if( g.eHashPolicy<0 ){
g.eHashPolicy = hname_default_policy();
db_set_int("hash-policy", g.eHashPolicy, 0);
}
|
| ︙ | ︙ | |||
3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 |
** --keep Only modify the manifest and manifest.uuid files
** --nested Allow opening a repository inside an opened checkout
** --repodir DIR If REPOSITORY is a URI that will be cloned, store
** the clone in DIR rather than in "."
** --setmtime Set timestamps of all files to match their SCM-side
** times (the timestamp of the last checkin which modified
** them).
** --workdir DIR Use DIR as the working directory instead of ".". The DIR
** directory is created if it does not exist.
**
** See also: [[close]], [[clone]]
*/
void cmd_open(void){
int emptyFlag;
int keepFlag;
int forceMissingFlag;
int allowNested;
| > > > > > > | > | 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160 3161 3162 3163 3164 3165 3166 3167 3168 3169 3170 3171 3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 |
** --keep Only modify the manifest and manifest.uuid files
** --nested Allow opening a repository inside an opened checkout
** --repodir DIR If REPOSITORY is a URI that will be cloned, store
** the clone in DIR rather than in "."
** --setmtime Set timestamps of all files to match their SCM-side
** times (the timestamp of the last checkin which modified
** them).
** --symlinks Allow the use of symbolic links when expanding files
** in this check-out, overriding the global allow-symlinks
** setting (which default to "off"). CAUTION: This option
** might allow a malicious repository to overwrite files
** outside of the checkout directory. This option is a
** security risk and its use is discouraged.
** --workdir DIR Use DIR as the working directory instead of ".". The DIR
** directory is created if it does not exist.
**
** See also: [[close]], [[clone]]
*/
void cmd_open(void){
int emptyFlag;
int keepFlag;
int forceMissingFlag;
int allowNested;
int allowSymlinks = 0;
int setmtimeFlag; /* --setmtime. Set mtimes on files */
int bForce = 0; /* --force. Open even if non-empty dir */
static char *azNewArgv[] = { 0, "checkout", "--prompt", 0, 0, 0, 0 };
const char *zWorkDir; /* --workdir value */
const char *zRepo = 0; /* Name of the repository file */
const char *zRepoDir = 0; /* --repodir value */
char *zPwd; /* Initial working directory */
int isUri = 0; /* True if REPOSITORY is a URI */
url_proxy_options();
emptyFlag = find_option("empty",0,0)!=0;
keepFlag = find_option("keep",0,0)!=0;
forceMissingFlag = find_option("force-missing",0,0)!=0;
allowNested = find_option("nested",0,0)!=0;
setmtimeFlag = find_option("setmtime",0,0)!=0;
zWorkDir = find_option("workdir",0,1);
zRepoDir = find_option("repodir",0,1);
bForce = find_option("force",0,0)!=0;
if( find_option("symlinks",0,0)!=0 ) allowSymlinks = 1;
zPwd = file_getcwd(0,0);
/* We should be done with options.. */
verify_all_options();
if( g.argc!=3 && g.argc!=4 ){
|
| ︙ | ︙ | |||
3277 3278 3279 3280 3281 3282 3283 |
if( g.argc==4 ){
g.zOpenRevision = g.argv[3];
}else if( db_exists("SELECT 1 FROM event WHERE type='ci'") ){
g.zOpenRevision = db_get("main-branch", 0);
}
}
| < < < < < < < < < < < < < | < < < < < < < < < < < < < < < | 3273 3274 3275 3276 3277 3278 3279 3280 3281 3282 3283 3284 3285 3286 3287 3288 3289 3290 3291 3292 3293 3294 3295 3296 3297 3298 3299 3300 |
if( g.argc==4 ){
g.zOpenRevision = g.argv[3];
}else if( db_exists("SELECT 1 FROM event WHERE type='ci'") ){
g.zOpenRevision = db_get("main-branch", 0);
}
}
#if defined(_WIN32) || defined(__CYGWIN__)
# define LOCALDB_NAME "./_FOSSIL_"
#else
# define LOCALDB_NAME "./.fslckout"
#endif
db_init_database(LOCALDB_NAME, zLocalSchema, zLocalSchemaVmerge,
#ifdef FOSSIL_LOCAL_WAL
"COMMIT; PRAGMA journal_mode=WAL; BEGIN;",
#endif
(char*)0);
db_delete_on_failure(LOCALDB_NAME);
db_open_local(0);
if( allowSymlinks ) g.allowSymlinks = 1;
db_lset("repository", zRepo);
db_record_repository_filename(zRepo);
db_set_checkout(0);
azNewArgv[0] = g.argv[0];
g.argv = azNewArgv;
if( !emptyFlag ){
g.argc = 3;
|
| ︙ | ︙ | |||
3430 3431 3432 3433 3434 3435 3436 | */ /* ** SETTING: admin-log boolean default=off ** ** When the admin-log setting is enabled, configuration changes are recorded ** in the "admin_log" table of the repository. */ | < | | < | | | | > > | < < < > | < < < | < | 3398 3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 | */ /* ** SETTING: admin-log boolean default=off ** ** When the admin-log setting is enabled, configuration changes are recorded ** in the "admin_log" table of the repository. */ /* ** SETTING: allow-symlinks boolean default=off ** ** When allow-symlinks is OFF (which is the default and recommended setting) ** symbolic links a treated like text files that contain a single line of ** content which is the name of their target. If allow-symlinks is ON, ** the symbolic links are actually followed. ** ** The use of symbolic links is dangerous. If you checkout a maliciously ** crafted checkin that contains symbolic links, it is possible that files ** outside of the working directory might be overwritten. ** ** Keep this setting OFF unless you have a very good reason to turn it ** on and you implicitly trust the integrity of the repositories you ** open. */ /* ** SETTING: auto-captcha boolean default=on variable=autocaptcha ** If enabled, the /login page provides a button that will automatically ** fill in the captcha password. This makes things easier for human users, ** at the expense of also making logins easier for malicious robots. */ /* |
| ︙ | ︙ |
Changes to src/file.c.
| ︙ | ︙ | |||
1312 1313 1314 1315 1316 1317 1318 |
const char *zAllow = find_option("allow-symlinks",0,1);
if( find_option("open-config", 0, 0)!=0 ){
Th_OpenConfig(1);
}
db_find_and_open_repository(OPEN_ANY_SCHEMA|OPEN_OK_NOT_FOUND, 0);
fossil_print("filenames_are_case_sensitive() = %d\n",
filenames_are_case_sensitive());
| < < | 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 |
const char *zAllow = find_option("allow-symlinks",0,1);
if( find_option("open-config", 0, 0)!=0 ){
Th_OpenConfig(1);
}
db_find_and_open_repository(OPEN_ANY_SCHEMA|OPEN_OK_NOT_FOUND, 0);
fossil_print("filenames_are_case_sensitive() = %d\n",
filenames_are_case_sensitive());
if( zAllow ){
g.allowSymlinks = !is_false(zAllow);
}
fossil_print("db_allow_symlinks() = %d\n", db_allow_symlinks());
for(i=2; i<g.argc; i++){
emitFileStat(g.argv[i], slashFlag, resetFlag);
}
|
| ︙ | ︙ |
Changes to src/json_config.c.
| ︙ | ︙ | |||
81 82 83 84 85 86 87 |
{ "clean-glob", CONFIGSET_PROJ },
{ "ignore-glob", CONFIGSET_PROJ },
{ "keep-glob", CONFIGSET_PROJ },
{ "crlf-glob", CONFIGSET_PROJ },
{ "crnl-glob", CONFIGSET_PROJ },
{ "encoding-glob", CONFIGSET_PROJ },
{ "empty-dirs", CONFIGSET_PROJ },
| < | 81 82 83 84 85 86 87 88 89 90 91 92 93 94 |
{ "clean-glob", CONFIGSET_PROJ },
{ "ignore-glob", CONFIGSET_PROJ },
{ "keep-glob", CONFIGSET_PROJ },
{ "crlf-glob", CONFIGSET_PROJ },
{ "crnl-glob", CONFIGSET_PROJ },
{ "encoding-glob", CONFIGSET_PROJ },
{ "empty-dirs", CONFIGSET_PROJ },
{ "dotfiles", CONFIGSET_PROJ },
{ "ticket-table", CONFIGSET_TKT },
{ "ticket-common", CONFIGSET_TKT },
{ "ticket-change", CONFIGSET_TKT },
{ "ticket-newpage", CONFIGSET_TKT },
{ "ticket-viewpage", CONFIGSET_TKT },
|
| ︙ | ︙ |