From: valentin.haenel at gmx.de (Valentin Haenel)
Subject: [PATCHv3 2/3] Add ability to authorize viewing a repository
Date: Tue, 30 Oct 2012 11:11:29 +0100 [thread overview]
Message-ID: <1351591890-13605-3-git-send-email-valentin.haenel@gmx.de> (raw)
In-Reply-To: <1350378927-10834-1-git-send-email-valentin.haenel@gmx.de>
This provides a mechanism for cgit to query an external program for repository
authorisation, e.g. gitolite. An additional config variable 'authorization'
contains the path and name of the executable to use.
Signed-off-by: Valentin Haenel <valentin.haenel at gmx.de>
---
cgit.c | 22 ++++++++++++++++++++++
cgit.h | 1 +
cgitrc.5.txt | 6 ++++++
3 files changed, 29 insertions(+)
diff --git a/cgit.c b/cgit.c
index 5a8ae97a13..1bf1935b88 100644
--- a/cgit.c
+++ b/cgit.c
@@ -128,6 +128,8 @@ void config_cb(const char *name, const char *value)
ctx.cfg.readme = xstrdup(value);
else if (!strcmp(name, "user-envvar"))
ctx.cfg.user_envvar = xstrdup(value);
+ else if (!strcmp(name, "authz-exec"))
+ ctx.cfg.authorization_helper = xstrdup(value);
else if (!strcmp(name, "root-title"))
ctx.cfg.root_title = xstrdup(value);
else if (!strcmp(name, "root-desc"))
@@ -382,6 +384,7 @@ static void prepare_context(struct cgit_context *ctx)
ctx->cfg.max_atom_items = 10;
ctx->cfg.ssdiff = 0;
ctx->cfg.user_envvar = xstrdupn("REMOTE_USER");
+ ctx->cfg.authorization_helper = NULL;
ctx->env.cgit_config = xstrdupn(getenv("CGIT_CONFIG"));
ctx->env.http_host = xstrdupn(getenv("HTTP_HOST"));
ctx->env.https = xstrdupn(getenv("HTTPS"));
@@ -554,6 +557,25 @@ static void process_request(void *cbdata)
return;
}
+ /* Here we do the authorization check.
+ *
+ * TODO figure out if this is the correct place to do the check
+ *
+ */
+ if (ctx->cfg.authorization_helper && ctx->repo &&
+ system(fmt("'%s' '%s' '%s'",
+ ctx->cfg.authorization_helper,
+ ctx->repo->name,
+ ctx->env.remote_user)) != 0) {
+ cgit_print_http_headers(ctx);
+ cgit_print_docstart(ctx);
+ cgit_print_pageheader(ctx);
+ cgit_print_error(fmt("Authorization failed for repo: '%s' and user: '%s'",
+ ctx->repo->name, ctx->env.remote_user));
+ cgit_print_docend();
+ return;
+ }
+
if (ctx->repo && prepare_repo_cmd(ctx))
return;
diff --git a/cgit.h b/cgit.h
index 016baa8e7d..48888af0d3 100644
--- a/cgit.h
+++ b/cgit.h
@@ -167,6 +167,7 @@ struct cgit_query {
struct cgit_config {
char *agefile;
char *user_envvar;
+ char *authorization_helper;
char *cache_root;
char *clone_prefix;
char *clone_url;
diff --git a/cgitrc.5.txt b/cgitrc.5.txt
index d2fca9fb9c..fa51fe6a6e 100644
--- a/cgitrc.5.txt
+++ b/cgitrc.5.txt
@@ -40,6 +40,12 @@ agefile::
function in libgit. Recommended timestamp-format is "yyyy-mm-dd
hh:mm:ss". Default value: "info/web/last-modified".
+authorization_helper::
+ Specifies a path to authorization executable. The executable must take two
+ arguments: "<repository> <user> [<permissions>]". The permission is the
+ type of permission we wish to check for, e.g. "R" or "RW" or "RW+". Default
+ value: none.
+
cache-root::
Path used to store the cgit cache entries. Default value:
"/var/cache/cgit". See also: "MACRO EXPANSION".
--
1.7.9.5
next prev parent reply other threads:[~2012-10-30 10:11 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-16 9:15 [PATCH 0/3] Implement authorization via external program valentin.haenel
2012-10-16 9:15 ` [PATCH 1/3] Add config option user-envvar valentin.haenel
2012-10-28 1:11 ` Jason
2012-10-29 9:49 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-16 11:21 ` Jason
2012-10-16 12:48 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 2/3] Add ability to authorize viewing a repository using valentin.haenel
2012-10-16 9:17 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-22 8:29 ` [PATCHv2 1/3] Add config option user-envvar valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-29 9:22 ` valentin.haenel
2012-10-29 14:53 ` mathstuf
2012-10-29 15:50 ` valentin.haenel
2012-10-22 8:29 ` [PATCHv2 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-28 1:16 ` Jason
2012-10-28 1:29 ` mathstuf
2012-10-28 1:33 ` Jason
2012-10-29 9:43 ` valentin.haenel
2012-10-29 14:52 ` mathstuf
2012-10-29 15:45 ` valentin.haenel
2012-10-28 1:17 ` Jason
2012-10-29 12:38 ` valentin.haenel
2012-10-30 9:54 ` valentin.haenel
2012-10-28 1:14 ` Jason
2012-10-29 9:36 ` valentin.haenel
2012-10-22 8:29 ` [PATCHv2 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-29 9:27 ` valentin.haenel
2012-10-30 10:11 ` [PATCHv3 0/3] Implement authorization via external program (v3) valentin.haenel
2012-10-30 15:04 ` mathstuf
2012-10-30 16:30 ` Jason
2012-10-30 10:11 ` [PATCHv3 1/3] Add config option user-envvar valentin.haenel
2012-10-30 16:29 ` Jason
2012-10-30 10:11 ` valentin.haenel [this message]
2012-10-30 16:30 ` [PATCHv3 2/3] Add ability to authorize viewing a repository Jason
2012-10-30 10:11 ` [PATCHv3 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-30 15:05 ` mathstuf
2012-10-31 18:50 ` [PATCHv4 0/2] Authorize viewing a repository valentin.haenel
2012-10-31 18:52 ` [PATCHv4 1/2] Add ability to authorize " valentin.haenel
2012-10-31 18:52 ` [PATCHv4 2/2] Helper script to interface to gitolite valentin.haenel
2012-11-01 3:03 ` jamie.couture
2012-11-01 3:23 ` mathstuf
2012-11-01 4:20 ` Jason
2012-11-01 4:31 ` mathstuf
2012-11-01 8:58 ` valentin.haenel
2012-11-01 17:32 ` Jason
2012-11-01 10:40 ` [PATCHv4 0/2] Authorize viewing a repository valentin.haenel
2012-11-01 17:27 ` Jason
2012-11-01 17:32 ` valentin.haenel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1351591890-13605-3-git-send-email-valentin.haenel@gmx.de \
--to=cgit@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).