Patchwork [4,of,5,hgweb-thread-isolation] hgweb: move templatepath to requestcontext

login
register
mail settings
Submitter Gregory Szorc
Date Sept. 3, 2015, 12:24 a.m.
Message ID <0be65f46507519c504b6.1441239888@gps-mbp.local>
Download mbox | patch
Permalink /patch/10377/
State Accepted
Headers show

Comments

Gregory Szorc - Sept. 3, 2015, 12:24 a.m.
# HG changeset patch
# User Gregory Szorc <gregory.szorc@gmail.com>
# Date 1440286102 25200
#      Sat Aug 22 16:28:22 2015 -0700
# Node ID 0be65f46507519c504b61483b3ce169b04ae60b5
# Parent  3686e01864469c382536ef6a9ea0e292ba6bb182
hgweb: move templatepath to requestcontext

This does change behavior in that the templatepath could change during
the lifetime of the server. But everything else can change, I don't see
why template paths can't.

Patch

diff --git a/mercurial/hgweb/hgweb_mod.py b/mercurial/hgweb/hgweb_mod.py
--- a/mercurial/hgweb/hgweb_mod.py
+++ b/mercurial/hgweb/hgweb_mod.py
@@ -83,8 +83,14 @@  class requestcontext(object):
                            self.configint('web', 'maxfiles', 10))
         object.__setattr__(self, 'allowpull',
                            self.configbool('web', 'allowpull', True))
 
+        # we use untrusted=False to prevent a repo owner from using
+        # web.templates in .hg/hgrc to get access to any file readable
+        # by the user running the CGI script
+        object.__setattr__(self, 'templatepath',
+                           self.config('web', 'templates', untrusted=False))
+
     # Proxy unknown reads and writes to the application instance
     # until everything is moved to us.
     def __getattr__(self, name):
         return getattr(self.app, name)
@@ -157,12 +163,8 @@  class hgweb(object):
         hook.redirect(True)
         self.repostate = None
         self.mtime = -1
         self.reponame = name
-        # we use untrusted=False to prevent a repo owner from using
-        # web.templates in .hg/hgrc to get access to any file readable
-        # by the user running the CGI script
-        self.templatepath = self.config('web', 'templates', untrusted=False)
         self.websubtable = webutil.getwebsubs(r)
 
     # The CGI scripts are often run by a user different from the repo owner.
     # Trust the settings from the .hg/hgrc files by default.