Re: Confirm my false error suspicions of Gitweb query injection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Joseph Leong <josephcleong@xxxxxxxxx> writes:

> Hi Everyone,
>
> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).
>
> I was poking around and tried a GET Request (REQ) with some SQL
> statements as a search query and noticed a 500. Can i just confirm
> with anyone here that the error message I'm seeing in the Response
> (RESP) is basically saying that the search parameters are invalid
> because of it's funny chars are breaking the regex search and that
> it's not anything database related.

Yes, I think this was fixed in v1.7.9.4 if not earlier, with e65ceb6
(gitweb: Fix fixed string (non-regexp) project search, 2012-03-02).

--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]