Skip to content
Snippets Groups Projects
  1. Mar 29, 2018
    • Junio C Hamano's avatar
      Merge branch 'jh/partial-clone' · c2a499e6
      Junio C Hamano authored
      Hotfix.
      
      * jh/partial-clone:
        upload-pack: disable object filtering when disabled by config
        unpack-trees: release oid_array after use in check_updates()
      c2a499e6
    • Jonathan Nieder's avatar
      upload-pack: disable object filtering when disabled by config · c7620bd0
      Jonathan Nieder authored
      
      When upload-pack gained partial clone support (v2.17.0-rc0~132^2~12,
      2017-12-08), it was guarded by the uploadpack.allowFilter config item
      to allow server operators to control when they start supporting it.
      
      That config item didn't go far enough, though: it controls whether the
      'filter' capability is advertised, but if a (custom) client ignores
      the capability advertisement and passes a filter specification anyway,
      the server would handle that despite allowFilter being false.
      
      This is particularly significant if a security bug is discovered in
      this new experimental partial clone code.  Installations without
      uploadpack.allowFilter ought not to be affected since they don't
      intend to support partial clone, but they would be swept up into being
      vulnerable.
      
      Simplify and limit the attack surface by making uploadpack.allowFilter
      disable the feature, not just the advertisement of it.
      
      Signed-off-by: default avatarJonathan Nieder <jrnieder@gmail.com>
      Signed-off-by: default avatarJunio C Hamano <gitster@pobox.com>
      c7620bd0
  2. Mar 28, 2018
  3. Mar 25, 2018
  4. Mar 23, 2018
  5. Mar 22, 2018
Loading