Re: Confirm my false error suspicions of Gitweb query injection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



and you earned bonus points for the details - thank you very much!


On Mon, Sep 10, 2012 at 10:37 AM, Junio C Hamano <gitster@xxxxxxxxx> wrote:
> Joseph Leong <josephcleong@xxxxxxxxx> writes:
>
>> Hi Everyone,
>>
>> I'm using Gitweb (Based on Git 1.7.9 on RHEL 5.8).
>>
>> I was poking around and tried a GET Request (REQ) with some SQL
>> statements as a search query and noticed a 500. Can i just confirm
>> with anyone here that the error message I'm seeing in the Response
>> (RESP) is basically saying that the search parameters are invalid
>> because of it's funny chars are breaking the regex search and that
>> it's not anything database related.
>
> Yes, I think this was fixed in v1.7.9.4 if not earlier, with e65ceb6
> (gitweb: Fix fixed string (non-regexp) project search, 2012-03-02).
>
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]