deac/gitolite
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge branch 'master' into wildrepos

Browse source 
Conflicts:
	src/gitolite.pm
	src/gl-auth-command
This commit is contained in:
Sitaram Chamarty 2009-12-19 22:51:29 +05:30
commit d49bb6b423
7 changed files with 56 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

42
src/gl-auth-command
View file

@ -23,9 +23,8 @@ use warnings;
# common definitions
# ----------------------------------------------------------------------------
# these are set by the "rc" file
our ($GL_LOGT, $GL_CONF_COMPILED, $REPO_BASE, $GIT_PATH, $GL_ADMINDIR);
our ($GL_LOGT, $GL_CONF_COMPILED, $REPO_BASE, $GIT_PATH, $REPO_UMASK, $GL_ADMINDIR);
# and these are set by gitolite.pm
our ($R_COMMANDS, $W_COMMANDS, $REPONAME_PATT);
our %repos;
@ -39,13 +38,29 @@ require "$bindir/gitolite.pm";
&where_is_rc();
die "parse $ENV{GL_RC} failed: " . ($! or $@) unless do $ENV{GL_RC};
# we need to pass GL_ADMINDIR and the bindir to the child hooks (well only the
# admin repo's post-update hook but still...)
$ENV{GL_ADMINDIR} = $GL_ADMINDIR;
$ENV{GL_BINDIR} = $bindir;
# add a custom path for git binaries, if specified
$ENV{PATH} .= ":$GIT_PATH" if $GIT_PATH;
# set the umask before creating any files
umask($REPO_UMASK);
# ----------------------------------------------------------------------------
# start...
# ----------------------------------------------------------------------------
# if the first argument is a "-s", this user is allowed to get a shell using
# this key
my $shell_allowed = 0;
if ($ARGV[0] eq '-s') {
$shell_allowed = 1;
shift;
}
# first, fix the biggest gripe I have with gitosis, a 1-line change
my $user=$ENV{GL_USER}=shift; # there; now that's available everywhere!
@ -53,8 +68,14 @@ my $user=$ENV{GL_USER}=shift; # there; now that's available everywhere!
# sanity checks on SSH_ORIGINAL_COMMAND
# ----------------------------------------------------------------------------
# SSH_ORIGINAL_COMMAND must exist; if not, we die with a nice message
# print basic access info if SSH_ORIGINAL_COMMAND does not exist
unless ($ENV{SSH_ORIGINAL_COMMAND}) {
# unless the user is allowed to use a shell
if ($shell_allowed) {
my $shell = $ENV{SHELL};
$shell =~ s/.*\//-/; # change "/bin/bash" to "-bash"
exec { $ENV{SHELL} } $shell;
}
&report_basic($GL_ADMINDIR, $GL_CONF_COMPILED, $user);
exit 1;
}
@ -87,6 +108,12 @@ if ($cmd =~ $CUSTOM_COMMANDS) {
exit 1;
}
# people allowed to get a shell can get basic access info by asking nicely
if ($shell_allowed and $cmd eq 'info') {
&report_basic($GL_ADMINDIR, $GL_CONF_COMPILED, $user);
exit 1;
}
# ----------------------------------------------------------------------------
# normal (git) processing
# ----------------------------------------------------------------------------
@ -100,9 +127,12 @@ if ($cmd =~ $CUSTOM_COMMANDS) {
# including the single quotes
my ($verb, $repo) = ($cmd =~ /^\s*(git\s+\S+|\S+)\s+'\/?(.*?)(?:.git)?'/);
die "bad command: $cmd. Make sure the repo name is exactly as in your config\n"
unless ( $verb and ( $verb =~ $R_COMMANDS or $verb =~ $W_COMMANDS )
and $repo and $repo =~ $REPONAME_PATT );
unless ( $verb and ( $verb =~ $R_COMMANDS or $verb =~ $W_COMMANDS ) and $repo and $repo =~ $REPONAME_PATT ) {
# if the user is allowed a shell, just run the command
exec $ENV{SHELL}, "-c", $ENV{SSH_ORIGINAL_COMMAND} if $shell_allowed;
# otherwise, whine
die "bad command: $cmd\n";
}
die "$repo ends with a slash; I don't like that\n" if $repo =~ /\/$/;
die "$repo has two consecutive periods; I don't like that\n" if $repo =~ /\.\./;