# HG changeset patch # User Mads Kiilerich # Date 1539216410 -7200 # Node ID 21084a951cd9e9859b47e2d42bd2f8908da5e7e4 # Parent bc166701b0c58ab333f924dfb6c03801a3636cdd hg: make __get_action command parsing simpler and safer diff -r bc166701b0c5 -r 21084a951cd9 kallithea/lib/base.py --- a/kallithea/lib/base.py Mon Jul 02 01:55:49 2018 +0200 +++ b/kallithea/lib/base.py Thu Oct 11 02:06:50 2018 +0200 @@ -218,7 +218,7 @@ Checks permissions using action (push/pull) user and repository name - :param action: push or pull action + :param action: 'push' or 'pull' action :param user: `User` instance :param repo_name: repository name """ diff -r bc166701b0c5 -r 21084a951cd9 kallithea/lib/middleware/simplehg.py --- a/kallithea/lib/middleware/simplehg.py Mon Jul 02 01:55:49 2018 +0200 +++ b/kallithea/lib/middleware/simplehg.py Thu Oct 11 02:06:50 2018 +0200 @@ -264,8 +264,7 @@ def __get_action(self, environ): """ - Maps mercurial request commands into a clone,pull or push command. - This should always return a valid command string + Maps Mercurial request commands into 'pull' or 'push'. :param environ: """ @@ -276,12 +275,10 @@ 'unbundle': 'push', 'pushkey': 'push', } for qry in environ['QUERY_STRING'].split('&'): - if qry.startswith('cmd'): - cmd = qry.split('=')[-1] - if cmd in mapping: - return mapping[cmd] - - return 'pull' + parts = qry.split('=', 1) + if len(parts) == 2 and parts[0] == 'cmd': + cmd = parts[1] + return mapping.get(cmd, 'pull') raise Exception('Unable to detect pull/push action !!' 'Are you using non standard command or client ?')