From: jamie.couture at gmail.com (Jamie Couture)
Subject: [PATCHv4 2/2] Helper script to interface to gitolite
Date: Wed, 31 Oct 2012 23:03:01 -0400 [thread overview]
Message-ID: <20121101030301.GA28025@neptune.phub.net.cable.rogers.com> (raw)
In-Reply-To: <1351709556-29355-2-git-send-email-valentin.haenel@gmx.de>
On Wed, Oct 31, 2012 at 07:52:36PM +0100, Valentin Haenel wrote:
> From: Carlos Aguado Sanchez <carlos.aguado at epfl.ch>
>
> Signed-off-by: Carlos Aguado Sanchez <carlos.aguado at epfl.ch>
> Signed-off-by: Valentin Haenel <valentin.haenel at gmx.de>
> ---
> contrib/gl-check-user | 20 ++++++++++++++++++++
> 1 file changed, 20 insertions(+)
> create mode 100755 contrib/gl-check-user
>
> diff --git a/contrib/gl-check-user b/contrib/gl-check-user
> new file mode 100755
> index 0000000000..45eb95fead
> --- /dev/null
> +++ b/contrib/gl-check-user
> @@ -0,0 +1,20 @@
> +#!/bin/sh
> +# Wrapper around gitolite to perform
> +# repository authentication from a
> +# CGI environment
> +prog="/usr/local/bin/gitolite"
What about users that have installed gitolite via their distro's
package manager, as opposed to local install?
I do not think the script should assume to know where gitolite lives.
This might be agnostic:
prog="$(which gitolite)"
But that could lead to PATH abuse; potential security problems.
Maybe obtaining the value from another environment variable, say in
your web server's virtual host:
SetEnv GITOLITE_PROG /path/to/gitolite
---
prog="${GITOLITE_PROG}"
Not sure how much of a crutch that is, but I wouldn't want the helper
script to assume where gitolite lives; and if any distro were to
include these scripts people might want it to work out of the box.
> +
> +# HTTPD will not set some essential
> +# variables expexted by gitolite
> +# Set them here (EUID expected final)
> +
> +export REPO="${CGIT_REPO_URL%.git}"
> +# Get the user from webserver environment.
> +# May be either REMOTE_USER or HTTP_X_FORWARDED_USER
> +export REMOTE_USER="${HTTP_X_FORWARDED_USER}"
> +# Looking for read permission from gitolite
> +export PERM="R"
> +# Gitolite needs homedir set
> +export HOME="$( getent passwd $(id -n -u) | cut -d":" -f 6 )"
> +
> +exec "$prog" access -q "${REPO}" "${REMOTE_USER}" "${PERM}"
> --
> 1.7.9.5
>
>
> _______________________________________________
> cgit mailing list
> cgit at hjemli.net
> http://hjemli.net/mailman/listinfo/cgit
next prev parent reply other threads:[~2012-11-01 3:03 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-10-16 9:15 [PATCH 0/3] Implement authorization via external program valentin.haenel
2012-10-16 9:15 ` [PATCH 1/3] Add config option user-envvar valentin.haenel
2012-10-28 1:11 ` Jason
2012-10-29 9:49 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-16 11:21 ` Jason
2012-10-16 12:48 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 2/3] Add ability to authorize viewing a repository using valentin.haenel
2012-10-16 9:17 ` valentin.haenel
2012-10-16 9:15 ` [PATCH 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-22 8:29 ` [PATCHv2 1/3] Add config option user-envvar valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-29 9:22 ` valentin.haenel
2012-10-29 14:53 ` mathstuf
2012-10-29 15:50 ` valentin.haenel
2012-10-22 8:29 ` [PATCHv2 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-28 1:16 ` Jason
2012-10-28 1:29 ` mathstuf
2012-10-28 1:33 ` Jason
2012-10-29 9:43 ` valentin.haenel
2012-10-29 14:52 ` mathstuf
2012-10-29 15:45 ` valentin.haenel
2012-10-28 1:17 ` Jason
2012-10-29 12:38 ` valentin.haenel
2012-10-30 9:54 ` valentin.haenel
2012-10-28 1:14 ` Jason
2012-10-29 9:36 ` valentin.haenel
2012-10-22 8:29 ` [PATCHv2 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-28 1:00 ` mathstuf
2012-10-29 9:27 ` valentin.haenel
2012-10-30 10:11 ` [PATCHv3 0/3] Implement authorization via external program (v3) valentin.haenel
2012-10-30 15:04 ` mathstuf
2012-10-30 16:30 ` Jason
2012-10-30 10:11 ` [PATCHv3 1/3] Add config option user-envvar valentin.haenel
2012-10-30 16:29 ` Jason
2012-10-30 10:11 ` [PATCHv3 2/3] Add ability to authorize viewing a repository valentin.haenel
2012-10-30 16:30 ` Jason
2012-10-30 10:11 ` [PATCHv3 3/3] Helper script to interface to gitolite valentin.haenel
2012-10-30 15:05 ` mathstuf
2012-10-31 18:50 ` [PATCHv4 0/2] Authorize viewing a repository valentin.haenel
2012-10-31 18:52 ` [PATCHv4 1/2] Add ability to authorize " valentin.haenel
2012-10-31 18:52 ` [PATCHv4 2/2] Helper script to interface to gitolite valentin.haenel
2012-11-01 3:03 ` jamie.couture [this message]
2012-11-01 3:23 ` mathstuf
2012-11-01 4:20 ` Jason
2012-11-01 4:31 ` mathstuf
2012-11-01 8:58 ` valentin.haenel
2012-11-01 17:32 ` Jason
2012-11-01 10:40 ` [PATCHv4 0/2] Authorize viewing a repository valentin.haenel
2012-11-01 17:27 ` Jason
2012-11-01 17:32 ` valentin.haenel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121101030301.GA28025@neptune.phub.net.cable.rogers.com \
--to=cgit@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).