]> git.vanrenterghem.biz Git - git.ikiwiki.info.git/commit
Tell `git revert` not to follow renames (CVE-2016-10026)
authorSimon McVittie <smcv@debian.org>
Mon, 19 Dec 2016 13:48:56 +0000 (13:48 +0000)
committerSimon McVittie <smcv@debian.org>
Wed, 11 Jan 2017 15:29:51 +0000 (15:29 +0000)
commit1d7d1b8d1793547bc55fa2344e36cef9c11bcb95
treedd3be699ccb92253d879bcfbe00d29b9b778f495
parent4dc25d3b56bde059eae9aecbd761a8fc3c08e37e
Tell `git revert` not to follow renames (CVE-2016-10026)

Otherwise, we have an authorization bypass vulnerability: rcs_preprevert
looks at what changed in the commit we are reverting, not at what would
result from reverting it now. In particular, if some files were renamed
since the commit we are reverting, a revert of changes that were within
the designated subdirectory and allowed by check_canchange() might now
affect files that are outside the designated subdirectory or disallowed
by check_canchange().

Signed-off-by: Simon McVittie <smcv@debian.org>
IkiWiki/Plugin/git.pm