gitweb: Check permissions first in git_search
Check first if relevant features: 'search', 'pickaxe', 'grep', as appropriate, are enabled before doing anything else in git_search. This should make git_search code more clear. While at it, expand a bit error message (e.g. 'Pickaxe' -> 'Pickaxe search'). Signed-off-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jakub Narebski committed
Jun 22, 2011 at 17:28 UTC
e0ca364551fcde3b3d825f93f4a4d44d7ab9eb35
1 file changed
+21
-13
gitweb/gitweb.perl
+21
-13
@@ -313,6 +313,10 @@ our %feature = (
313
# Enable text search, which will list the commits which match author,
314
# committer or commit text to a given string. Enabled by default.
315
# Project specific override is not supported.
316
+ #
317
+ # Note that this controls all search features, which means that if
318
+ # it is disabled, then 'grep' and 'pickaxe' search would also be
319
+ # disabled.
320
'search' => {
321
'override' => 0,
322
'default' => [1]},
@@ -6787,7 +6791,23 @@ sub git_history {
6791
}
6792
6793
sub git_search {
6790
- gitweb_check_feature('search') or die_error(403, "Search is disabled");
6794
+ $searchtype ||= 'commit';
6795
+
6796
+ # check if appropriate features are enabled
6797
+ gitweb_check_feature('search')
6798
+ or die_error(403, "Search is disabled");
6799
+ if ($searchtype eq 'pickaxe') {
6800
+ # pickaxe may take all resources of your box and run for several minutes
6801
+ # with every query - so decide by yourself how public you make this feature
6802
+ gitweb_check_feature('pickaxe')
6803
+ or die_error(403, "Pickaxe search is disabled");
6804
+ }
6805
+ if ($searchtype eq 'grep') {
6806
+ # grep search might be potentially CPU-intensive, too
6807
+ gitweb_check_feature('grep')
6808
+ or die_error(403, "Grep search is disabled");
6809
+ }
6810
+
6811
if (!defined $searchtext) {
6812
die_error(400, "Text field is empty");
6813
}
@@ -6802,18 +6822,6 @@ sub git_search {
6822
$page = 0;
6823
}
6824
6805
- $searchtype ||= 'commit';
6806
- if ($searchtype eq 'pickaxe') {
6807
- # pickaxe may take all resources of your box and run for several minutes
6808
- # with every query - so decide by yourself how public you make this feature
6809
- gitweb_check_feature('pickaxe')
6810
- or die_error(403, "Pickaxe is disabled");
6811
- }
6812
- if ($searchtype eq 'grep') {
6813
- gitweb_check_feature('grep')
6814
- or die_error(403, "Grep is disabled");
6815
- }
6816
-
6825
git_header_html();
6826
6827
if ($searchtype eq 'commit' or $searchtype eq 'author' or $searchtype eq 'committer') {