{"thread":{"id":"32721","subject":"Separately repository access in GitWeb","startedAt":"2013-01-25T08:10:43Z","lastAt":"2013-01-25T09:00:40Z","messageCount":2,"participants":["Андрей Баранов"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"207770","messageId":"CAJjU7bS-rRr-UuEA_xcqtTY4+tWKshL+Rvey85n70KacSnTorQ@mail.gmail.com","threadId":"32721","inReplyTo":null,"subject":"Separately repository access in GitWeb","fromName":"Андрей Баранов","fromEmail":"andrej.andb@gmail.com","sentAt":"2013-01-25T08:10:43Z","receivedAt":"2013-01-25T08:10:43Z","isPatch":false,"sender":{"key":"andrej.andb@gmail.com","avatar":null},"body":"good day.\n\nI`m trying make separately repository access in GitWeb by NGINX\n\nseparation of access based on URL strings, namely, the presence of the\nquery strings:\n'?p=repo.git'\nwith a regular expression:\n\"^.*p=(.*?)(\\.git|;|&|=|\\s).*$\"\n\nI am wondering how much it is correct to protect against unauthorized access.\n\nThanks in advance :)\n\ncomplete example of a configuration file:\n\nserver {\n        listen 80;\n\nroot /home/git/gitweb;\n\n        access_log /var/log/nginx/gitweb.access_log main;\n        error_log /var/log/nginx/gitweb.error_log info;\n\n        index gitweb.cgi;\ngzip off;\n\n    location ~* \\.(jpg|txt|jpeg|gif|png|ico|css|zip|js|swf)$ {\naccess_log        off;\n        expires 1d;\n    }\n\n    location = / {\nset $htpasswd \"opened@\";\nif ($args ~* \"^.*p=(.*?)(\\.git|;|&|=|\\s).*$\") {\nset $htpasswd /home/git/.gitolite/conf/$1_htpasswd;\n        }\n        if (-f $htpasswd) {\n                rewrite ^.*$  /closed last;\n        }\n\nrewrite ^.*$ /guest last;\n    }\n\n    location = /closed {\ninternal;\naccess_log /var/log/nginx/gitweb-closed.access_log main;\nauth_basic \"Unauthorized\";\n        auth_basic_user_file $htpasswd;\n        include fastcgi_params;\n        fastcgi_param  SCRIPT_NAME gitweb.cgi;\n        fastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;\n        fastcgi_pass unix:/var/run/fcgiwrap.socket;\n    }\n\n    location = /guest {\ninternal;\naccess_log /var/log/nginx/gitweb-guest.access_log main;\n        include fastcgi_params;\nfastcgi_param  SCRIPT_NAME gitweb.cgi;\nfastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;\n        fastcgi_pass unix:/var/run/fcgiwrap.socket;\n    }\n\n    location  / {\n        rewrite (.*) / permanent;\n    }\n\n}\n"},{"id":"207775","messageId":"CAJjU7bQ65q_oznTV57oMM4XPkHrEUwZ-TZ4UzRHp=k7VkfMDGg@mail.gmail.com","threadId":"32721","inReplyTo":"CAJjU7bS-rRr-UuEA_xcqtTY4+tWKshL+Rvey85n70KacSnTorQ@mail.gmail.com","subject":"Fwd: Separately repository access in GitWeb","fromName":"Андрей Баранов","fromEmail":"admin@andrej-andb.ru","sentAt":"2013-01-25T09:00:40Z","receivedAt":"2013-01-25T09:00:40Z","isPatch":false,"sender":{"key":"admin@andrej-andb.ru","avatar":"https://gravatar.com/avatar/911e65da5a0561cab1e8ee11c2da0f495d1252ac54ba7eb474cde5a91ade07d5?d=mp&s=160"},"body":"good day.\n\nI`m trying make separately repository access in GitWeb by NGINX\n\nseparation of access based on URL strings, namely, the presence of the\nquery strings:\n'?p=repo.git'\nwith a regular expression:\n\"^.*p=(.*?)(\\.git|;|&|=|\\s).*$\"\n\nI am wondering how much it is correct to protect against unauthorized access.\n\nThanks in advance :)\n\ncomplete example of a configuration file:\n\nserver {\n        listen 80;\n\nroot /home/git/gitweb;\n\n        access_log /var/log/nginx/gitweb.access_log main;\n        error_log /var/log/nginx/gitweb.error_log info;\n\n        index gitweb.cgi;\ngzip off;\n\n    location ~* \\.(jpg|txt|jpeg|gif|png|ico|css|zip|js|swf)$ {\naccess_log        off;\n        expires 1d;\n    }\n\n    location = / {\nset $htpasswd \"opened@\";\nif ($args ~* \"^.*p=(.*?)(\\.git|;|&|=|\\s).*$\") {\nset $htpasswd /home/git/.gitolite/conf/$1_htpasswd;\n        }\n        if (-f $htpasswd) {\n                rewrite ^.*$  /closed last;\n        }\n\nrewrite ^.*$ /guest last;\n    }\n\n    location = /closed {\ninternal;\naccess_log /var/log/nginx/gitweb-closed.access_log main;\nauth_basic \"Unauthorized\";\n        auth_basic_user_file $htpasswd;\n        include fastcgi_params;\n        fastcgi_param  SCRIPT_NAME gitweb.cgi;\n        fastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;\n        fastcgi_pass unix:/var/run/fcgiwrap.socket;\n    }\n\n    location = /guest {\ninternal;\naccess_log /var/log/nginx/gitweb-guest.access_log main;\n        include fastcgi_params;\nfastcgi_param  SCRIPT_NAME gitweb.cgi;\nfastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;\n        fastcgi_pass unix:/var/run/fcgiwrap.socket;\n    }\n\n    location  / {\n        rewrite (.*) / permanent;\n    }\n\n}\n"}]}