{"thread":{"id":"31766","subject":"gitweb bug: Existence if hidden repositories is leaked","startedAt":"2012-10-09T09:28:53Z","lastAt":"2012-10-09T09:28:53Z","messageCount":1,"participants":["Ralf Jung"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"200827","messageId":"5073EE55.7010809@ralfj.de","threadId":"31766","inReplyTo":null,"subject":"gitweb bug: Existence if hidden repositories is leaked","fromName":"Ralf Jung","fromEmail":"post@ralfj.de","sentAt":"2012-10-09T09:28:53Z","receivedAt":"2012-10-09T09:28:53Z","isPatch":false,"sender":{"key":"post@ralfj.de","avatar":null},"body":"Hi list,\n\nI am using gitweb, git-daemon and gitolite on my Debian Squeeze server.\nI have some repositories however that I do not want to be available to\nthe public (currently, that is gitolite-admin only). Those repositories\ndo not have a \"git-daemon-export-ok\" file, and the gitweb config contains\n\n# path to git projects (<project>.git)\n$projectroot = \"/home/git/repositories\";\n# only show repos which allow daemon access\n$export_ok = \"git-daemon-export-ok\";\n\nI am also using pathinfo to get prettier URLs. However, if I now try to\naccess gitolite-admin.git in the browser, I get \"404 Project Not Found\".\nIf I try to access some repository which dos not actually exist, I am\nredirected to the project index. This way, the existence of hidden\nrepositories is disclosed.\n\nThe problem is in the function evaluate_path_info which uses\ncheck_head_link to find out which part of the URL is the project.\nReplacing this by check_export_ok fixes the problem.\n\nKind regards,\nRalf\n\nPS: Please keep me in CC, I am not subscribed.\n"}]}