From 3001099cdaaf1fde8e622f4f3c47a3f891315c5d Mon Sep 17 00:00:00 2001
From: Sunil Mohan Adapa <sunil@medhas.org>
Date: Sat, 19 Oct 2019 18:41:39 -0700
Subject: [PATCH] gitweb: Fix issue with elevated access to private
 repositories

When using git-http-backend, both URLs ending with and without .git are allowed.
However, access restriction has only be applied for URLs ending with .git. This
means that private git repositories are clone-able by anonymous users by
removing the .git suffix in the URLs.

Fix the issue by extending the access restriction to cover URLs not ending with
.git.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
---
 .../data/etc/apache2/conf-available/gitweb-freedombox.conf    | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/plinth/modules/gitweb/data/etc/apache2/conf-available/gitweb-freedombox.conf b/plinth/modules/gitweb/data/etc/apache2/conf-available/gitweb-freedombox.conf
index e67340bcb..726fd5820 100644
--- a/plinth/modules/gitweb/data/etc/apache2/conf-available/gitweb-freedombox.conf
+++ b/plinth/modules/gitweb/data/etc/apache2/conf-available/gitweb-freedombox.conf
@@ -57,9 +57,7 @@ Alias /gitweb /usr/share/gitweb
     SetEnvIfExpr "%{QUERY_STRING} =~ /service=git-receive-pack/" AUTHREQUIRED
     SetEnvIfExpr "%{REQUEST_URI} =~ /git-receive-pack$/" AUTHREQUIRED
     # Authentication is required for any operation if repository is private.
-    <If "%{REQUEST_URI} =~ m#^/gitweb/([^/]+)# && -f '/var/lib/git/$1/private'">
-        SetEnvIfExpr true AUTHREQUIRED
-    </If>
+    SetEnvIfExpr "%{REQUEST_URI} =~ m#^/gitweb/([^/]+)# && ( -f '/var/lib/git/$1/private' || -f '/var/lib/git/$1.git/private' )" AUTHREQUIRED
 
     # Either authentication is not required for this operation and repository
     # combination, or...