From: valentin.haenel at gmx.de (Valentin Haenel)
Subject: [PATCH 2/3] Add ability to authorize viewing a repository using
Date: Tue, 16 Oct 2012 11:17:44 +0200 [thread overview]
Message-ID: <20121016091744.GJ26844@kudu.in-berlin.de> (raw)
In-Reply-To: <1350378927-10834-4-git-send-email-valentin.haenel@gmx.de>
You can ignore this one, sorry.
* Valentin Haenel <valentin.haenel at gmx.de> [2012-10-16]:
> This provides a mechanism for cgit to query an external program for repository
> authorisation. An additional config variable 'authorization' is
> ---
> cgit.c | 24 ++++++++++++++++++++++++
> cgit.h | 1 +
> cgitrc.5.txt | 6 ++++++
> 3 files changed, 31 insertions(+)
>
> diff --git a/cgit.c b/cgit.c
> index 101954e12a..f06528215d 100644
> --- a/cgit.c
> +++ b/cgit.c
> @@ -123,6 +123,8 @@ void config_cb(const char *name, const char *value)
> ctx.cfg.readme = xstrdup(value);
> else if (!strcmp(name, "user-envvar"))
> ctx.cfg.user_envvar = xstrdup(value);
> + else if (!strcmp(name, "authorization"))
> + ctx.cfg.authorization = xstrdup(value);
> else if (!strcmp(name, "root-title"))
> ctx.cfg.root_title = xstrdup(value);
> else if (!strcmp(name, "root-desc"))
> @@ -372,6 +374,7 @@ static void prepare_context(struct cgit_context *ctx)
> ctx->cfg.summary_tags = 10;
> ctx->cfg.max_atom_items = 10;
> ctx->cfg.ssdiff = 0;
> + ctx->cfg.authorization = "/bin/true";
> ctx->cfg.user_envvar = "REMOTE_USER";
> ctx->env.cgit_config = xstrdupn(getenv("CGIT_CONFIG"));
> ctx->env.http_host = xstrdupn(getenv("HTTP_HOST"));
> @@ -545,6 +548,27 @@ static void process_request(void *cbdata)
> return;
> }
>
> + /* Here we do the authorization check.
> + *
> + * TODO
> + * ----
> + * * figure out if this is the correct place to do the check
> + * * check that the authorization script exists and is executable
> + *
> + */
> + if (ctx->repo && system(fmt("%s %s %s",
> + ctx->cfg.authorization,
> + ctx->repo->name,
> + ctx->env.remote_user)) != 0) {
> + cgit_print_http_headers(ctx);
> + cgit_print_docstart(ctx);
> + cgit_print_pageheader(ctx);
> + cgit_print_error(fmt("Authorization failed for repo: '%s' and user: '%s'",
> + ctx->repo->name, ctx->env.remote_user));
> + cgit_print_docend();
> + exit(1);
> + }
> +
> if (ctx->repo && prepare_repo_cmd(ctx))
> return;
>
> diff --git a/cgit.h b/cgit.h
> index 369dd8af8b..43f4f562f3 100644
> --- a/cgit.h
> +++ b/cgit.h
> @@ -166,6 +166,7 @@ struct cgit_query {
> struct cgit_config {
> char *agefile;
> char *user_envvar;
> + char *authorization;
> char *cache_root;
> char *clone_prefix;
> char *clone_url;
> diff --git a/cgitrc.5.txt b/cgitrc.5.txt
> index cd7327a4b3..d864289502 100644
> --- a/cgitrc.5.txt
> +++ b/cgitrc.5.txt
> @@ -40,6 +40,12 @@ agefile::
> function in libgit. Recommended timestamp-format is "yyyy-mm-dd
> hh:mm:ss". Default value: "info/web/last-modified".
>
> +authorization::
> + Specifies a path to authorization executable. The executable must take two
> + arguments: "<repository> <user> [<permissions>]". The permission is the
> + type of permission we wish to check for, e.g. "R" or "RW" or "RW+". A
> + common use case is to call gitolite through this machinery.
> +
> cache-root::
> Path used to store the cgit cache entries. Default value:
> "/var/cache/cgit". See also: "MACRO EXPANSION".
> --
> 1.7.9.5
>
next prev parent reply other threads:[~2012-10-16 9:17 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-16 9:15 [PATCH 0/3] Implement authorization via external program valentin.haenel
2012-10-16 9:15 ` [PATCH 1/3] Add config option user-envvar valentin.haenel
2012-10-28 1:11 ` Jason
2012-10-29 9:49 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-16 11:21 ` Jason
2012-10-16 12:48 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 2/3] Add ability to authorize viewing a repository using valentin.haenel
2012-10-16 9:17 ` valentin.haenel [this message]
2012-10-16 9:15 ` [PATCH 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-22 8:29 ` [PATCHv2 1/3] Add config option user-envvar valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-29 9:22 ` valentin.haenel
2012-10-29 14:53 ` mathstuf
2012-10-29 15:50 ` valentin.haenel
2012-10-22 8:29 ` [PATCHv2 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-28 1:16 ` Jason
2012-10-28 1:29 ` mathstuf
2012-10-28 1:33 ` Jason
2012-10-29 9:43 ` valentin.haenel
2012-10-29 14:52 ` mathstuf
2012-10-29 15:45 ` valentin.haenel
2012-10-28 1:17 ` Jason
2012-10-29 12:38 ` valentin.haenel
2012-10-30 9:54 ` valentin.haenel
2012-10-28 1:14 ` Jason
2012-10-29 9:36 ` valentin.haenel
2012-10-22 8:29 ` [PATCHv2 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-29 9:27 ` valentin.haenel
2012-10-30 10:11 ` [PATCHv3 0/3] Implement authorization via external program (v3) valentin.haenel
2012-10-30 15:04 ` mathstuf
2012-10-30 16:30 ` Jason
2012-10-30 10:11 ` [PATCHv3 1/3] Add config option user-envvar valentin.haenel
2012-10-30 16:29 ` Jason
2012-10-30 10:11 ` [PATCHv3 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-30 16:30 ` Jason
2012-10-30 10:11 ` [PATCHv3 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-30 15:05 ` mathstuf
2012-10-31 18:50 ` [PATCHv4 0/2] Authorize viewing a repository valentin.haenel
2012-10-31 18:52 ` [PATCHv4 1/2] Add ability to authorize " valentin.haenel
2012-10-31 18:52 ` [PATCHv4 2/2] Helper script to interface to gitolite valentin.haenel
2012-11-01 3:03 ` jamie.couture
2012-11-01 3:23 ` mathstuf
2012-11-01 4:20 ` Jason
2012-11-01 4:31 ` mathstuf
2012-11-01 8:58 ` valentin.haenel
2012-11-01 17:32 ` Jason
2012-11-01 10:40 ` [PATCHv4 0/2] Authorize viewing a repository valentin.haenel
2012-11-01 17:27 ` Jason
2012-11-01 17:32 ` valentin.haenel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121016091744.GJ26844@kudu.in-berlin.de \
--to=cgit@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).