Comments
Patch
@@ -305,11 +305,16 @@ def _runcatch(req):
# shenanigans wherein a user does something like pass
# --debugger or --config=ui.debugger=1 as a repo
# name. This used to actually run the debugger.
- if (len(req.args) != 4 or
+ nbargs = 4
+ hashiddenaccess = '--hidden' in cmdargs
+ if hashiddenaccess:
+ nbargs += 1
+ if (len(req.args) != nbargs or
req.args[0] != '-R' or
req.args[1].startswith('--') or
req.args[2] != 'serve' or
- req.args[3] != '--stdio'):
+ req.args[3] != '--stdio' or
+ hashiddenaccess and req.args[4] != '--hidden'):
raise error.Abort(
_('potentially unsafe serve --stdio invocation: %s') %
(stringutil.pprint(req.args),))