diff --git a/app/controllers/projects/git/trees_controller.rb b/app/controllers/projects/git/trees_controller.rb index 07b7b75de..d19e4fe31 100644 --- a/app/controllers/projects/git/trees_controller.rb +++ b/app/controllers/projects/git/trees_controller.rb @@ -11,17 +11,17 @@ class Projects::Git::TreesController < Projects::Git::BaseController def archive format = params[:format] - if (@treeish =~ /^#{@project.owner.uname}-#{@project.name}-/) && !(@treeish =~ /[\s]+/) && (format =~ /^[\w]+$/) + if (@treeish =~ /^#{@project.owner.uname}-#{@project.name}-/) && !(@treeish =~ /[\s]+/) && (format =~ /^(zip|tar\.gz)$/) @treeish = @treeish.gsub(/^#{@project.owner.uname}-#{@project.name}-/, '') @commit = @project.repo.commits(@treeish, 1).first end raise Grit::NoSuchPathError unless @commit name = "#{@project.owner.uname}-#{@project.name}-#{@treeish}" - fullname = "#{name}.#{format == 'tar' ? 'tar.gz' : 'zip'}" + fullname = "#{name}.#{format == 'zip' ? 'zip' : 'tar.gz'}" file = Tempfile.new fullname, 'tmp' - system("cd #{@project.path}; git archive --format=#{format} --prefix=#{name}/ #{@treeish} #{format == 'tar' ? ' | gzip -9' : ''} > #{file.path}") + system("cd #{@project.path}; git archive --format=#{format} --prefix=#{name}/ #{@treeish} #{format == 'zip' ? '' : ' | gzip -9'} > #{file.path}") file.close - send_file file.path, :disposition => 'attachment', :type => "application/#{format == 'tar' ? 'x-tar-gz' : 'zip'}", :filename => fullname + send_file file.path, :disposition => 'attachment', :type => "application/#{format == 'zip' ? 'zip' : 'x-tar-gz'}", :filename => fullname end end diff --git a/app/views/projects/base/_repo_block.html.haml b/app/views/projects/base/_repo_block.html.haml index 55687f66b..d8788f420 100644 --- a/app/views/projects/base/_repo_block.html.haml +++ b/app/views/projects/base/_repo_block.html.haml @@ -7,7 +7,7 @@ %b.caret %ul.dropdown-menu - file_name = "#{@project.owner.uname}-#{@project.name}-#{@commit.id}" - %li=link_to "tar.gz", archive_path(project, file_name, 'tar') + %li=link_to "tar.gz", archive_path(project, file_name, 'tar.gz') %li=link_to "zip", archive_path(project, file_name, 'zip') = text_field_tag :url, git_repo_url(project.git_repo_name), :class => 'name', :spellcheck => 'false', :readonly => true diff --git a/config/routes.rb b/config/routes.rb index 82c553f74..1cd3dd360 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -222,7 +222,7 @@ Rosa::Application.routes.draw do # Raw get '/raw/:treeish/*path' => "git/blobs#raw", :as => :raw, :format => false # Archive - get '/archive/:treeish.:format' => "git/trees#archive", :as => :archive, :format => /zip|tar/ + get '/archive/:treeish.:format' => "git/trees#archive", :as => :archive, :format => /zip|tar\.gz/ end end end diff --git a/spec/controllers/projects/git/git_trees_controller_spec.rb b/spec/controllers/projects/git/git_trees_controller_spec.rb index 4f4941c02..5bf420e11 100644 --- a/spec/controllers/projects/git/git_trees_controller_spec.rb +++ b/spec/controllers/projects/git/git_trees_controller_spec.rb @@ -20,13 +20,13 @@ describe Projects::Git::TreesController do context 'for guest' do it 'should be able to perform archive action with anonymous acccess', :anonymous_access => true do fill_project - get :archive, @params.merge(:format => 'tar') + get :archive, @params.merge(:format => 'tar.gz') response.should be_success end it 'should not be able to perform archive action without anonymous acccess', :anonymous_access => false do fill_project - get :archive, @params.merge(:format => 'tar') + get :archive, @params.merge(:format => 'tar.gz') response.code.should == '401' end end @@ -35,14 +35,14 @@ describe Projects::Git::TreesController do it 'should not be able to archive empty project' do @user = FactoryGirl.create(:user) set_session_for(@user) - expect { get :archive, @params.merge(:format => 'tar') }.to raise_error(ActionController::RoutingError) + expect { get :archive, @params.merge(:format => 'tar.gz') }.to raise_error(ActionController::RoutingError) end it 'should not be able to injection code with format' do @user = FactoryGirl.create(:user) set_session_for(@user) fill_project - expect { get :archive, @params.merge(:format => "tar master > /dev/null; echo 'I am hacker!';\#") }.to raise_error(ActionController::RoutingError) + expect { get :archive, @params.merge(:format => "tar.gz master > /dev/null; echo 'I am hacker!';\#") }.to raise_error(ActionController::RoutingError) end it 'should not be able to injection code with treeish' do @@ -56,7 +56,7 @@ describe Projects::Git::TreesController do @user = FactoryGirl.create(:user) set_session_for(@user) fill_project - get :archive, @params.merge(:format => 'tar') + get :archive, @params.merge(:format => 'tar.gz') response.should be_success end end