From 88e0d281888b78ce9f6d90c5450da832306cd13e Mon Sep 17 00:00:00 2001 From: "Kyle J. McKay" Date: Sat, 13 Jun 2015 20:13:18 -0700 Subject: [PATCH] gitweb: avoid spurious check_head_link matches Do not allow symlinks to existing files that are not relative symlinks starting with 'refs/heads/'. Do not allow any types other than a symlink or plain file. Previously a symbolic link to any existing file or directory would be allowed as well as any kind of object that existed with the name 'HEAD' (including directories). Signed-off-by: Kyle J. McKay --- gitweb/gitweb.perl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index 1223e10dc4..87fa1f4cae 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -665,8 +665,8 @@ sub feature_extra_branch_refs { sub check_head_link { my ($dir) = @_; my $headfile = "$dir/HEAD"; - return ((-e $headfile) || - (-l $headfile && readlink($headfile) =~ /^refs\/heads\//)); + return -l $headfile ? + readlink($headfile) =~ /^refs\/heads\// : -f $headfile; } sub check_export_ok { -- 2.11.4.GIT