testing: Disable variable dump by default

It's a security risk to allow gitano to write to an arbitrary path
based on the value of an environment variable.

It's low risk since by default gitano is run directly by
the http or ssh server, which do not set variables by default,
but it's trivial enough to leave it commented out.

1 files changed, 2 insertions, 0 deletions

diff --git a/lib/gitano/repository.lua b/lib/gitano/repository.lua
index e48267f..12c0248 100644
--- a/lib/gitano/repository.lua
+++ b/lib/gitano/repository.lua
@@ -165,6 +165,7 @@ end
 function repo_method:run_lace(context)
    self:populate_context(context)
    config.populate_context(self.config, context)
+   --[[ Uncomment this to enable variable dumping.
    local vardump = luxio.getenv("GITANO_DUMP_VARIABLE_FILE")
    if vardump then
       local io = require "io"
@@ -188,6 +189,7 @@ function repo_method:run_lace(context)
       fh:write(pretty.write(t))
       fh:close()
    end
+   --]]
    return lace.run(self.lace, context)
 end