[whimsy] branch master updated: Don't add auth if no password; dup before untaint

[sebb]

This is an automated email from the ASF dual-hosted git repository.

sebb pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/whimsy.git


The following commit(s) were added to refs/heads/master by this push:
     new 4c60989  Don't add auth if no password; dup before untaint
4c60989 is described below

commit 4c609898f3a43184f0dce005ce54b9794400792c
Author: Sebb <s...@apache.org>
AuthorDate: Sat Jun 13 22:38:50 2020 +0100

    Don't add auth if no password; dup before untaint
---
 www/secretary/workbench/tasks.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/www/secretary/workbench/tasks.rb b/www/secretary/workbench/tasks.rb
index 7234239..178c67a 100644
--- a/www/secretary/workbench/tasks.rb
+++ b/www/secretary/workbench/tasks.rb
@@ -59,7 +59,7 @@ class Wunderbar::JsonBuilder
   end
 
   def svn *args
-    args << svnauth if %(checkout update commit).include? args.first
+    args << svnauth if env.password and %(checkout update 
commit).include?(args.first)
     _.system! 'svn', *args
   end
 
@@ -67,8 +67,8 @@ class Wunderbar::JsonBuilder
     [
       '--non-interactive', 
       '--no-auth-cache',
-      '--username', env.user.untaint,
-      '--password', env.password.untaint
+      '--username', env.user.dup.untaint, # could be frozen
+      '--password', env.password.dup.untaint
     ]
   end