From cdb8dbafe22fa3de4cd26c37da01c3b210255150 Mon Sep 17 00:00:00 2001 From: Patrick Georgi Date: Sat, 3 Sep 2011 19:30:34 +0200 Subject: [PATCH] Write-protect git repository over HTTP! I totally misunderstood the access control mechanism (but it's logical that it behaves the way it does), and so on git projects with "open" source access, repos were write-for-all. This should fix it by enforcing member-or-owner auth for writes. Signed-off-by: Patrick Georgi --- src/IDF/Scm/Git.php | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/src/IDF/Scm/Git.php b/src/IDF/Scm/Git.php index 5c7aae0..6f9f60f 100644 --- a/src/IDF/Scm/Git.php +++ b/src/IDF/Scm/Git.php @@ -982,8 +982,14 @@ class IDF_Scm_Git extends IDF_Scm if ($path == 'info/refs' && !empty($request->GET['service'])){ $service = $request->GET['service']; switch ($service) { - case 'git-upload-pack': case 'git-receive-pack': + if (IDF_Precondition::projectMemberOrOwner($request) !== true) { + $response = new Pluf_HTTP_Response(""); + $response->status_code = 401; + $response->headers['WWW-Authenticate']='Basic realm="git for '.$this->project.'"'; + return $response; + } + case 'git-upload-pack': $content = sprintf('%04x',strlen($service)+15). '# service='.$service."\n0000"; $content .= self::shell_exec('IDF_Scm_Git::repository', @@ -1000,8 +1006,14 @@ class IDF_Scm_Git extends IDF_Scm switch($path) { // smart HTTP RPC - case 'git-upload-pack': case 'git-receive-pack': + if (IDF_Precondition::projectMemberOrOwner($request) !== true) { + $response = new Pluf_HTTP_Response(""); + $response->status_code = 401; + $response->headers['WWW-Authenticate']='Basic realm="git for '.$this->project.'"'; + return $response; + } + case 'git-upload-pack': $response = new Pluf_HTTP_Response_CommandPassThru( Pluf::f('idf_exec_cmd_prefix', '').$path. ' --stateless-rpc '.$this->repo,