Make hgweb.staticfile() more secure and portable. Without this, files in directories next to the static directory starting with 'static' could be retrieved, e.g. with '../static.private/foo'. Additionally staticfile now generates platform specific pathnames from the /-separated paths given in the URL. Illegal file names (e.g. containing %00) now yield a sane error message.

     1

#!/bin/sh

     2

#

     3

mkdir t

     4

cd t

     5

hg init

     6

echo 0 > a

     7

echo 0 > b

     8

hg ci -A -m m -d "0 0"

     9

hg rm a

    10

hg cat a

    11

sleep 1 # make sure mtime is changed

    12

echo 1 > b

    13

hg ci -m m -d "0 0"

    14

echo 2 > b

    15

hg cat -r 0 a

    16

hg cat -r 0 b

    17

hg cat -r 1 a

    18

hg cat -r 1 b