#!/bin/sh

echo -n -e "Content-Type: text/plain\n\n"

cd /my/repos/$PATH_INFO
hg init

ScriptAlias /unsafecreate /path/to/unsafecreate.cgi

Invoke as:

GET http://your-poorly-admined-host.com/unsafecrete/path/to/new/repo

#!/bin/sh

# Note: depending on shell echo might need -n -e flags

REPO_ROOT=/path/to/repos
REPO_URL=http://myserver.example.com/hg

echo "Content-Type: text/html\n\n"

REPO_PATH=$REPO_ROOT/$PATH_INFO
if [ -f $REPO_PATH ]; then
 echo "File $PATH_INFO already exists!"
 exit;
fi;

if [ -d $REPO_PATH ]; then
 echo "Directory $PATH_INFO already exists!"
 exit;
fi;

mkdir -p $REPO_PATH
cd $REPO_PATH
hg init
HGRC=$REPO_PATH/.hg/hgrc

echo "[web]\ndescription = Automatically created $PATH_INFO\nallow_push = *\n" $

echo "Repository <a href=\"$REPO_URL$PATH_INFO\">$PATH_INFO</a> created!"

Looks great, but do keep in mind that these will be dangerous:

GET /script/../../muhahaha

GET /script/%3Brm%20-rf%20