deac/gitolite
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

new method for passing usergroup info (warning: minor backward compat breakage)

Browse source 
The old method of passing in usergroup info had some problems, which are
now fixed.  It is also much easier to use now -- no more "wrapper"
script, plus it should work identially whether you use sshd or httpd.

See doc/big-config.mkd for details on the new method.

----

Notes on problems with the old method:

The old method for passing in usergroup info consisted of tacking them
on as extra arguments to gl-auth-command, after the username.

However, there are some problems with this method.

Some actions in gitolite look for permissions for users other than the
invoking user.  Determining permissions for gitweb and daemon is one.
An admin asking for "info" on some other user, is another.

However, the list of groups sent in via the command line
pertains only to the invoking user, so these actions don't work
correctly.  They may even pick up the wrong permissions.

What it all boils down to is that we need group information for any user
dynamically, instead of being passed a (static) list just for the
invoking user.
This commit is contained in:
Sitaram Chamarty 2010-10-07 16:36:14 +05:30
parent ba39d93e28
commit db0485fa7e
4 changed files with 65 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/gl-auth-command
View file

@ -114,10 +114,6 @@ if ($ENV{REQUEST_URI}) {
$user=$ENV{GL_USER}=shift;
}
# if there are any more arguments, they're a list of group names that the user
# is a member of
$ENV{GL_GROUP_LIST} = join(" ", @ARGV) if @ARGV;
# ----------------------------------------------------------------------------
# logging, timestamp env vars
# ----------------------------------------------------------------------------