Patchwork [2,of,2] bookmarks: hide bookmarks on filtered revs from listkeys

login
register
mail settings
Submitter Kevin Bullock
Date Jan. 27, 2013, 9:15 p.m.
Message ID <c7c39a1ddac831857206.1359321359@vpn0-813.vpn.umn.edu>
Download mbox | patch
Permalink /patch/748/
State Accepted
Commit d1c13a4dc638cefc71728da24f91a723313b049e
Headers show

Comments

Kevin Bullock - Jan. 27, 2013, 9:15 p.m.
# HG changeset patch
# User Kevin Bullock <kbullock@ringworld.org>
# Date 1359321233 21600
# Branch stable
# Node ID c7c39a1ddac8318572061e35e347f6570052b0f8
# Parent  14fe65a26547fe63963f4e6062b26f07a9443860
bookmarks: hide bookmarks on filtered revs from listkeys

Don't expose unserved changesets to remote repos. Thanks to Sean Farley
<sean.michael.farley@gmail.com> for tracking down the issue and
Pierre-Yves David <pierre-yves.david@ens-lyon.org> for the fix.

Patch

diff --git a/mercurial/bookmarks.py b/mercurial/bookmarks.py
--- a/mercurial/bookmarks.py
+++ b/mercurial/bookmarks.py
@@ -183,9 +183,10 @@  def listbookmarks(repo):
     marks = getattr(repo, '_bookmarks', {})
 
     d = {}
+    hasnode = repo.changelog.hasnode
     for k, v in marks.iteritems():
         # don't expose local divergent bookmarks
-        if '@' not in k or k.endswith('@'):
+        if hasnode(v) and ('@' not in k or k.endswith('@')):
             d[k] = hex(v)
     return d
 
diff --git a/tests/test-hgweb-commands.t b/tests/test-hgweb-commands.t
--- a/tests/test-hgweb-commands.t
+++ b/tests/test-hgweb-commands.t
@@ -1386,4 +1386,10 @@  bookmarks view doesn't choke on bookmark
   $ QUERY_STRING='style=raw'
   $ python hgweb.cgi
 
+listbookmarks hides secret bookmarks
+
+  $ PATH_INFO=/; export PATH_INFO
+  $ QUERY_STRING='cmd=listkeys&namespace=bookmarks'
+  $ python hgweb.cgi
+
   $ cd ..