{"schema":"libjg2-1", "vpath":"/git/", "avatar":"/git/avatar/", "alang":"", "gen_ut":1745907717, "reponame":"cgit", "desc":"CGI gitweb", "owner": { "name": "Andy Green", "email": "andy@warmcat.com", "md5": "c50933ca2aa61e0fe2c43d46bb6b59cb" },"url":"https://warmcat.com/repo/cgit", "f":3, "items": [ {"schema":"libjg2-1", "cid":"d250b8219ade6f0cdcd077f077918515", "commit": {"type":"commit", "time": 1530115879, "time_ofs": 120, "oid_tree": { "oid": "ac2e435498cd75ebe6e50ac1b05c102c884cce8f", "alias": []}, "oid":{ "oid": "00ad47bbfaf7cc5c372e072a5302e871b5250390", "alias": []}, "msg": "ui-snapshot: filter permitted snapshot requests", "sig_commit": { "git_time": { "time": 1530115879, "offset": 120 }, "name": "Jason A. Donenfeld", "email": "Jason@zx2c4.com", "md5": "689e78dac56e3d77d7f74984912487d3" }, "sig_author": { "git_time": { "time": 1522505992, "offset": 60 }, "name": "John Keeping", "email": "john@keeping.me.uk", "md5": "aea7d8738c91da1cb0dfa9d86f2bbc47" }}, "body": "ui-snapshot: filter permitted snapshot requests\n\nCurrently the snapshots configuration option only filters which links\nare displayed, not which snapshots may be generated and downloaded.\nApply the filter also to requests to ensure that the system policy is\nenforced.\n\nSigned-off-by: John Keeping \u003cjohn@keeping.me.uk\u003e\nReviewed-by: Christian Hesse \u003cmail@eworm.de\u003e\n" , "diff": "diff --git a/ui-snapshot.c b/ui-snapshot.c\nindex b9e2a36..abf8399 100644\n--- a/ui-snapshot.c\n+++ b/ui-snapshot.c\n@@ -194,7 +194,7 @@ void cgit_print_snapshot(const char *head, const char *hex,\n \t}\n \n \tf \u003d get_format(filename);\n-\tif (!f) {\n+\tif (!f || !(ctx.repo-\u003esnapshots \u0026 f-\u003ebit)) {\n \t\tcgit_print_error_page(400, \u0022Bad request\u0022,\n \t\t\t\t\u0022Unsupported snapshot format: %s\u0022, filename);\n \t\treturn;\n","s":{"c":1745907717,"u": 597}} ],"g": 1686,"chitpc": 0,"ehitpc": 0,"indexed":0 , "ab": 0, "si": 0, "db":0, "di":0, "sat":0, "lfc": "0000"}