There is a format string vulnerability introduced with the packed refs
file format.
Signed-off-by: NPetr Baudis <pasky@suse.cz>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

This was lost in the packed-ref updates. The original test was a bit
dubious, so I cleaned that up, too. It fixes the case when the current HEAD
is refs/heads/bla/master: the original test was true for both bla/master
_and_ master.

However, it shares a hard-to-fix bug with the original test: if the current
HEAD is refs/heads/master, and there is a branch refs/heads/heads/master,
then both are marked active.
Signed-off-by: NJohannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

It called read_ref(git_path(..)..), where read_ref does the git_path()
stuff itself.
Signed-off-by: NJohannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

"git pack-refs --prune", after successfully packing the existing
refs, removes the loose ref files.  It tries to protect against
race by doing the usual lock_ref_sha1() which makes sure the
contents of the ref has not changed since we last looked at.

Also we do not bother trying to prune what was already packed, and
we do not try pruning symbolic refs.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Now we can tell which one is symbolic and which one is not, it
is easy to do so.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

This adds a "int *flag" parameter to resolve_ref() and makes
for_each_ref() family to call callback function with an extra
"int flag" parameter.  They are used to give two bits of
information (REF_ISSYMREF and REF_ISPACKED) about the ref.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

This is a long overdue fix to the API for for_each_ref() family
of functions.  It allows the callers to specify a callback data
pointer, so that the caller does not have to use static
variables to communicate with the callback funciton.

The updated for_each_ref() family takes a function of type

	int (*fn)(const char *, const unsigned char *, void *)

and a void pointer as parameters, and calls the function with
the name of the ref and its SHA-1 with the caller-supplied void
pointer as parameters.

The commit updates two callers, builtin-name-rev.c and
builtin-pack-refs.c as an example.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

An earlier conversion accidentally hardcoded "HEAD" to be passed to
resolve_ref(), thereby causing git-symbolic-ref command to always
report where the HEAD points at, ignoring the command line parameter.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Current git#next is totally broken wrt. cloning over HTTP, generating refs
at random directories. Of course it's caused by the static get_pathname()
buffer. lock_ref_sha1() stores return value of mkpath()'s get_pathname()
call, then calls lock_ref_sha1_basic() which calls git_path(ref) which
calls get_pathname() at that point returning pointer to the same buffer.
So now you are sprintf()ing a format string into itself, wow! The resulting
pathnames are really cute. (If you've been paying attention, yes, the
mere fact that a format string _could_ write over itself is very wrong
and probably exploitable here. See the other mail I've just sent.)

I've never liked how we use return values of those functions so liberally,
the "allow some random number of get_pathname() return values to work
concurrently" is absolutely horrible pit and we've already fallen in this
before IIRC. I consider it an awful coding practice, you add a call
somewhere and at some other point some distant caller of that breaks since
it reuses the same return values. Not to mention this takes quite some time
to debug.

My gut feeling tells me that there might be more of this.  I don't have
time to review the rest of the users of the refs.c functions though.
Signed-off-by: NPetr Baudis <pasky@suse.cz>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Signed-off-by: NJunio C Hamano <junkio@cox.net>

Signed-off-by: NJunio C Hamano <junkio@cox.net>

Signed-off-by: NJunio C Hamano <junkio@cox.net>

It depended on specific error messages to detect failure but the
implementation changed and broke the test.  This fixes the breakage
minimally.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

This actually "turns on" the packed ref file format, now that the
infrastructure to do so sanely exists (ie notably the change to make the
reference reading logic take refnames rather than pathnames to the loose
objects that no longer necessarily even exist).

In particular, when the ref lookup hits a refname that has no loose file
associated with it, it falls back on the packed-ref information. Also, the
ref-locking code, while still using a loose file for the locking itself
(and _creating_ a loose file for the new ref) no longer requires that the
old ref be in such an unpacked state.

Finally, this does a minimal hack to git-checkout.sh to rather than check
the ref-file directly, do a "git-rev-parse" on the "heads/$refname".
That's not really wonderful - we should rather really have a special
routine to verify the names as proper branch head names, but it is a
workable solution for now.

With this, I can literally do something like

	git pack-refs
	find .git/refs -type f -print0 | xargs -0 rm -f --

and the end result is a largely working repository (ie I've done two
commits - which creates _one_ unpacked ref file - done things like run
"gitk" and "git log" etc, and it all looks ok).

There are probably things missing, but I'm hoping that the missing things
are now of the "small and obvious" kind, and that somebody else might want
to start looking at this too. Hint hint ;)
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

The old code used to totally mix up the notion of a ref-name and the path
that that ref was associated with.  That was not only horribly ugly (a
number of users got the path, and then wanted to try to turn it back into
a ref-name again), but it fundamnetally doesn't work at all once we do any
setup where a ref doesn't have a 1:1 relationship with a particular
pathname.

This fixes things up so that we use the ref-name throughout, and only
turn it into a pathname once we actually look it up in the filesystem.
That makes a lot of things much clearer and more straightforward.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

You can remove a ref that is packed two different ways: either simply
repack all the refs without that one, or create a loose ref that has the
magic all-zero SHA1.

This also adds back the test that a ref actually has the object it
points to.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

This also adds some very rudimentary support for the notion of packed
refs.  HOWEVER! At this point it isn't used to actually look up a ref
yet, only for listing them (ie "for_each_ref()" and friends see the
packed refs, but none of the other single-ref lookup routines).

Note how we keep two separate lists: one for the loose refs, and one for
the packed refs we read. That's so that we can easily keep the two apart,
and read only one set or the other (and still always make sure that the
loose refs take precedence).

[ From this, it's not actually obvious why we'd keep the two separate
  lists, but it's important to have the packed refs on their own list
  later on, when I add support for looking up a single loose one.

  For that case, we will want to read _just_ the packed refs in case the
  single-ref lookup fails, yet we may end up needing the other list at
  some point in the future, so keeping them separated is important ]
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

* sk/ftp:
  Add ftp:// protocol support for git-http-fetch
  http-fetch.c: consolidate code to detect missing fetch target

* jc/pack:
  pack-objects: document --revs, --unpacked and --all.
  pack-objects --unpacked=<existing pack> option.
  pack-objects: further work on internal rev-list logic.
  pack-objects: run rev-list equivalent internally.
  Separate object listing routines out of rev-list

* jc/am:
  Fix git-am safety checks

* jk/diff:
  wt-status: remove extraneous newline from 'deleted:' output
  git-status: document colorization config options
  Teach runstatus about --untracked
  git-commit.sh: convert run_status to a C builtin
  Move color option parsing out of diff.c and into color.[ch]
  diff: support custom callbacks for output

Currently it is possible to give any string ending with a number as
page.  -1 for example is quite bad (error log shows probably 100
warnings).
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Copy and pasted from git-pack-objects(1).
Signed-off-by: NJonas Fonseca <fonseca@diku.dk>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Signed-off-by: NJonas Fonseca <fonseca@diku.dk>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Signed-off-by: NJunio C Hamano <junkio@cox.net>

The current code works like this: if others flags than POLLIN is
raised we assume that (a) something bad happened and the child died or
(b) the child has closed the pipe because it had no more data to send.

For the latter case, we assume wrongly that one call to
process_input() will empty the pipe. Indeed it reads only 16Ko of data
by call and the the pipe capacity can be larger than that (on current
Linux kernel, it is 65536 bytes). Therefore the child can write 32ko
of data, for example, and close the pipe. After that poll will return
POLLIN _and_ POLLHUP and the parent will read only 16ko of data.

This patch forces the parent to empty the pipe as soon as POLLIN is
raised and even if POLLHUP or something else is raised too.

Moreover, some implementations of poll might return POLLRDNORM flag
even if it is non standard.
Signed-off-by: NFranck Bui-Huu <vagabon.xyz@gmail.com>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

* jc/archive:
  git-tar-tree: devolve git-tar-tree into a wrapper for git-archive
  git-archive: inline default_parse_extra()
  builtin-archive.c: rename remote_request() to extract_remote_arg()
  upload-archive: monitor child communication more carefully.
  Add sideband status report to git-archive protocol
  Prepare larger packet buffer for upload-pack protocol.
  Teach --exec to git-archive --remote
  Add --verbose to git-archive
  archive: force line buffered output to stderr
  Use xstrdup instead of strdup in builtin-{tar,zip}-tree.c
  Move sideband server side support into reusable form.
  Move sideband client side support into reusable form.
  archive: allow remote to have more formats than we understand.
  git-archive: make compression level of ZIP archives configurable
  Add git-upload-archive
  git-archive: wire up ZIP format.
  git-archive: wire up TAR format.
  Add git-archive

$export_ok: If this variable evaluates to true it is checked
if a file with this name exists in the repository.  If it
does not exist the repository cannot be viewed from gitweb.
(Similar to git-daemon-export-ok for git-daemon).

$strict_export: If this variable evaluates to true only
repositories listed on the project-list-page of gitweb can
be accessed.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

undef $project; to prevent a file named description to be read.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

This patch removes the custom tree walker tree_traverse(), and makes
generate_tar() use write_tar_archive() and the infrastructure provided
by git-archive instead.

As a kind of side effect, make write_tar_archive() able to handle NULL
as base directory, as this is what the new and simple generate_tar()
uses to indicate the absence of a base directory.  This was simpler
and cleaner than playing tricks with empty strings.

The behaviour of git-tar-tree should be unchanged (quick tests didn't
indicate otherwise) except for the text of some error messages.
Signed-off-by: NRene Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Perl spit out a varning when "blob" or "blob_plain" actions were
used without a $hash parameter.
Signed-off-by: NMartin Waitz <tali@admingilde.org>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Now three types of path based URLs are supported:
	gitweb.cgi/project.git
	gitweb.cgi/project.git/branch
	gitweb.cgi/project.git/branch/filename

The first one (show project summary) was already supported for a long time
now.  The other two are new: they show the shortlog of a branch or
the plain file contents of some file contained in the repository.

This is especially useful to support project web pages for small
projects: just create an html branch and then use an URL like
gitweb.cgi/project.git/html/index.html.
Signed-off-by: NMartin Waitz <tali@admingilde.org>
Acked-by: NJakub Narebski <jnareb@gmail.com>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

In "git-apply", we have a few sanity checks and heuristics that
expects that the patch fed to us is a unified diff with at least
one line of context.

 * When there is no leading context line in a hunk, the hunk
   must apply at the beginning of the preimage.  Similarly, no
   trailing context means that the hunk is anchored at the end.

 * We learn a patch deletes the file from a hunk that has no
   resulting line (i.e. all lines are prefixed with '-') if it
   has not otherwise been known if the patch deletes the file.
   Similarly, no old line means the file is being created.

And we declare an error condition when the file created by a
creation patch already exists, and/or when a deletion patch
still leaves content in the file.

These sanity checks are good safety measures, but breaks down
when people feed a diff generated with --unified=0.  This was
recently noticed first by Matthew Wilcox and Gerrit Pape.

This adds a new flag, --unified-zero, to allow bypassing these
checks.  If you are in control of the patch generation process,
you should not use --unified=0 patch and fix it up with this
flag; rather you should try work with a patch with context.  But
if all you have to work with is a patch without context, this
flag may come handy as the last resort.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

I had a hard time figuring out why this test was failing with
the packed-refs update without running it under "sh -x".  This
makes output from "sh t1400-update-ref.sh -v" more descriptive.

Updating other tests would be a good janitorial task.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Based on Sasha Khapyorsky's patch but adjusted to the refactored
"missing target" detection code.

It might have been better if the program were called
git-url-fetch but it is too late now ;-).
Signed-off-by: NJunio C Hamano <junkio@cox.net>

At a handful places we check two error codes from curl library
to see if the file we asked was missing from the remote (e.g.
we asked for a loose object when it is in a pack) to decide what
to do next.  This consolidates the check into a single function.

NOTE: the original did not check for HTTP_RETURNED_ERROR when
error code is 404, but this version does to make sure 404 is
from HTTP and not some other protcol.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

An earlier commit cbd64afb added a check that prevents "git-am"
to run without its standard input connected to a terminal while
resuming operation.  This was to catch a user error to try
feeding a new patch from its standard input while recovery.

The assumption of the check was that it is an indication that a
new patch is being fed if the standard input is not connected to
a terminal.  It is however not quite correct (the standard input
can be /dev/null if the user knows the operation does not need
any input, for example).  This broke t3403 when the test was run
with its standard input connected to /dev/null.

When git-am is given an explicit command such as --skip, there
is no reason to insist that the standard input is a terminal; we
are not going to read a new patch anyway.

Credit goes to Gerrit Pape for noticing and reporting the
problem with t3403-rebase-skip test.
Signed-off-by: NJunio C Hamano <junkio@cox.net>

This allows you to maintain a few filesystem pathnames concurrently, by
simply replacing the single static "pathname" buffer with a LRU of four
buffers.

We did exactly the same thing with sha1_to_hex(), for pretty much exactly
the same reason. Sometimes you want to use two pathnames, and while it's
easy enough to xstrdup() them, why not just do the LU buffer thing.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
Signed-off-by: NJunio C Hamano <junkio@cox.net>

Add link to "project_index" view as [TXT] beside link to "opml" view,
(which is marked by [OPML]) to "project_list" page.

While at it add alternate links for "opml" and "project_list" to HTML
header for "project_list" view.
Signed-off-by: NJakub Narebski <jnareb@gmail.com>
Signed-off-by: NJunio C Hamano <junkio@cox.net>