natalie/indefero
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Added the bulk of the access control to the git repositories.

Browse Source
This commit is contained in:
Loic d'Anterroches
2009-01-19 20:44:03 +01:00
parent b2ec9bb9e8
commit 941a495144
4 changed files with 110 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
src/IDF/Plugin/SyncGit/Cron.php
View File

@@ -29,8 +29,7 @@ class IDF_Plugin_SyncGit_Cron
/**
* Template for the SSH key.
*/
public $template = 'command="%s %s",no-port-forwarding,no-X11-forwarding,'
.'no-agent-forwarding,no-pty %s';
public $template = 'command="php %s %s",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty %s';
/**
* Synchronize.
@@ -38,8 +37,7 @@ class IDF_Plugin_SyncGit_Cron
public static function sync()
{
$template = Pluf::factory(__CLASS__)->template;
$keys = Pluf::factory('IDF_Key')->getList(array('view'=>'join_user'));
$cmd = Pluf::f('idf_plugin_syncgit_path_gitserve', '/bin/false');
$cmd = Pluf::f('idf_plugin_syncgit_path_gitserve', '/dev/null');
$authorized_keys = Pluf::f('idf_plugin_syncgit_path_authorized_keys', false);
if (false == $authorized_keys) {
throw new Pluf_Exception_SettingError('Setting git_path_authorized_keys not set.');
@@ -48,6 +46,7 @@ class IDF_Plugin_SyncGit_Cron
throw new Exception('Cannot create file: '.$authorized_keys);
}
$out = '';
$keys = Pluf::factory('IDF_Key')->getList(array('view'=>'join_user'));
foreach ($keys as $key) {
if (strlen($key->content) > 40 // minimal check
and preg_match('/^[a-zA-Z][a-zA-Z0-9_.-]*(@[a-zA-Z][a-zA-Z0-9.-]*)?$/', $key->login)) {
@@ -57,4 +56,16 @@ class IDF_Plugin_SyncGit_Cron
}
file_put_contents($authorized_keys, $out, LOCK_EX);
}
/**
* Check if a sync is needed.
*
*/
public static function main()
{
if (file_exists(Pluf::f('idf_plugin_syncgit_sync_file'))) {
@unlink(Pluf::f('idf_plugin_syncgit_sync_file'));
self::sync();
}
}
}

34
src/IDF/Plugin/SyncGit/Serve.php
View File

@@ -104,15 +104,13 @@ class IDF_Plugin_SyncGit_Serve
*/
public static function main($argv, $env)
{
if (count($argv) != 1) {
print('Missing argument USER.');
exit(1);
if (count($argv) != 2) {
self::fatalError('Missing argument USER.');
}
$username = $argv[0];
$username = $argv[1];
umask(0022);
if (!isset($env['SSH_ORIGINAL_COMMAND'])) {
print('Need SSH_ORIGINAL_COMMAND in environment.');
exit(1);
self::fatalError('Need SSH_ORIGINAL_COMMAND in environment.');
}
$cmd = $env['SSH_ORIGINAL_COMMAND'];
chdir(Pluf::f('idf_plugin_syncgit_git_home_dir', '/home/git'));
@@ -120,15 +118,10 @@ class IDF_Plugin_SyncGit_Serve
try {
$new_cmd = $serve->serve($username, $cmd);
} catch (Exception $e) {
print($e->getMessage());
exit(1);
self::fatalError($e->getMessage());
}
passthru(sprintf('git shell -c %s', $new_cmd), $res);
if ($res != 0) {
print('Cannot execute git-shell.');
exit(1);
}
exit();
print $new_cmd;
exit(0);
}
/**
@@ -164,6 +157,8 @@ class IDF_Plugin_SyncGit_Serve
$user = $users[0];
$request = new StdClass();
$request->user = $user;
$request->conf = $conf;
$request->project = $project;
if (true === IDF_Precondition::accessTabGeneric($request, 'source_access_rights')) {
if ($mode == 'readonly') {
return array(Pluf::f('idf_plugin_syncgit_base_repositories', '/home/git/repositories'),
@@ -177,6 +172,17 @@ class IDF_Plugin_SyncGit_Serve
return false;
}
/**
* Die on a message on stderr.
*
* @param string Message
*/
public static function fatalError($mess)
{
fwrite(STDERR, $mess."\n");
exit(1);
}
/**
* Init a new empty bare repository.
*