[whimsy] branch roster-emeritus updated: Don't add auth if no password; dup before untaint

[se...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sebb pushed a commit to branch roster-emeritus
in repository https://gitbox.apache.org/repos/asf/whimsy.git


The following commit(s) were added to refs/heads/roster-emeritus by this push:
     new ac6b696  Don't add auth if no password; dup before untaint
ac6b696 is described below

commit ac6b696efa942d287ae638b0506e49369fe21cea
Author: Sebb <se...@apache.org>
AuthorDate: Sat Jun 13 22:29:00 2020 +0100

    Don't add auth if no password; dup before untaint
---
 www/secretary/workbench/tasks.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/www/secretary/workbench/tasks.rb b/www/secretary/workbench/tasks.rb
index 7234239..01a2908 100644
--- a/www/secretary/workbench/tasks.rb
+++ b/www/secretary/workbench/tasks.rb
@@ -59,7 +59,7 @@ class Wunderbar::JsonBuilder
   end
 
   def svn *args
-    args << svnauth if %(checkout update commit).include? args.first
+    args << svnauth if env.password and %(checkout update commit).include?(args.first)
     _.system! 'svn', *args
   end
 
@@ -67,8 +67,8 @@ class Wunderbar::JsonBuilder
     [
       '--non-interactive', 
       '--no-auth-cache',
-      '--username', env.user.untaint,
-      '--password', env.password.untaint
+      '--username', env.user.dup.untaint, # may be frozen
+      '--password', env.password.dup.untaint
     ]
   end