gitweb: check given hash before trying to create snapshot

diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 24b219310a73f6ff8412b9236e7e5a95a7860e2f..8d4a2ae6004b38991e03d35113628c1a0304aa32 100755 (executable)
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -5196,8 +5196,11 @@ sub git_snapshot {
                die_error(403, "Unsupported snapshot format");
        }
 
-       if (!defined $hash) {
-               $hash = git_get_head_hash($project);
+       my $type = git_get_type("$hash^{}");
+       if (!$type) {
+               die_error(404, 'Object does not exist');
+       }  elsif ($type eq 'blob') {
+               die_error(400, 'Object is not a tree-ish');
        }
 
        my $name = $project;