nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-07-22 11:59:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

gitweb: Fix issue with elevated access to private repositories

Browse Source 
When using git-http-backend, both URLs ending with and without .git are allowed.
However, access restriction has only be applied for URLs ending with .git. This
means that private git repositories are clone-able by anonymous users by
removing the .git suffix in the URLs.

Fix the issue by extending the access restriction to cover URLs not ending with
.git.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
This commit is contained in:
Sunil Mohan Adapa 2019-10-19 18:41:39 -07:00
parent f581591521
commit 3001099cda
No known key found for this signature in database
GPG Key ID: 43EA1CFF0AA7C5F2
1 changed files with 1 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
plinth/modules/gitweb/data/etc/apache2/conf-available/gitweb-freedombox.conf
View File

@ -57,9 +57,7 @@ Alias /gitweb /usr/share/gitweb
SetEnvIfExpr "%{QUERY_STRING} =~ /service=git-receive-pack/" AUTHREQUIRED
SetEnvIfExpr "%{REQUEST_URI} =~ /git-receive-pack$/" AUTHREQUIRED
# Authentication is required for any operation if repository is private.
<If "%{REQUEST_URI} =~ m#^/gitweb/([^/]+)# && -f '/var/lib/git/$1/private'">
SetEnvIfExpr true AUTHREQUIRED
</If>
SetEnvIfExpr "%{REQUEST_URI} =~ m#^/gitweb/([^/]+)# && ( -f '/var/lib/git/$1/private' || -f '/var/lib/git/$1.git/private' )" AUTHREQUIRED
# Either authentication is not required for this operation and repository
# combination, or...