git, branch v2.11.4

Git 2.11.4

2017-09-22T05:44:45Z

Signed-off-by: Junio C Hamano

Sync with 2.10.5

2017-09-22T05:43:17Z

Signed-off-by: Junio C Hamano

Git 2.10.5

2017-09-22T05:42:22Z

Signed-off-by: Junio C Hamano

Merge branch 'jk/safe-pipe-capture' into maint-2.10

2017-09-22T05:34:34Z

Merge branch 'jk/cvsimport-quoting' into maint-2.10

2017-09-22T05:34:34Z

Merge branch 'jc/cvsserver' into maint-2.10

2017-09-22T05:34:34Z

Merge branch 'jk/git-shell-drop-cvsserver' into maint-2.10

2017-09-22T05:34:34Z

cvsimport: shell-quote variable used in backticks

2017-09-12T02:10:22Z

We run `git rev-parse` though the shell, and quote its argument only with single-quotes. This prevents most metacharacters from being a problem, but misses the obvious case when $name itself has single-quotes in it. We can fix this by applying the usual shell-quoting formula. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano

archimport: use safe_pipe_capture for user input

2017-09-12T02:08:15Z

Refnames can contain shell metacharacters which need to be passed verbatim to sub-processes. Using safe_pipe_capture skips the shell entirely. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano

shell: drop git-cvsserver support by default

2017-09-12T02:05:58Z

The git-cvsserver script is old and largely unmaintained these days. But git-shell allows untrusted users to run it out of the box, significantly increasing its attack surface. Let's drop it from git-shell's list of internal handlers so that it cannot be run by default. This is not backwards compatible. But given the age and development activity on CVS-related parts of Git, this is likely to impact very few users, while helping many more (i.e., anybody who runs git-shell and had no intention of supporting CVS). There's no configuration mechanism in git-shell for us to add a boolean and flip it to "off". But there is a mechanism for adding custom commands, and adding CVS support here is fairly trivial. Let's document it to give guidance to anybody who really is still running cvsserver. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano