{"thread":{"id":"38034","subject":"BUG in http-backend.c > http.receivepack","startedAt":"2014-11-24T08:18:52Z","lastAt":"2014-11-25T03:56:19Z","messageCount":2,"participants":["Springer, Stephan","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"252421","messageId":"F9AF62ADACFFBA47BEEADC5C12509F3401226EE8F8@Hermes.sns.local","threadId":"38034","inReplyTo":null,"subject":"BUG in http-backend.c > http.receivepack","fromName":"Springer, Stephan","fromEmail":"springer@sloman-neptun.com","sentAt":"2014-11-24T08:18:52Z","receivedAt":"2014-11-24T08:18:52Z","isPatch":false,"sender":{"key":"springer@sloman-neptun.com","avatar":null},"body":"Hello Guys,\n\nI found bug in http-backend.c with config-flag \"http.receivepack\"  You describe in our documentation: \"This serves git send-pack clients, allowing push. It is disabled by default for anonymous users, and enabled by default for users authenticated by the web server. It can be disabled by setting this item to false, or enabled for all users, including anonymous users, by setting it to true.\"\nThat cannot work, while svc-enable less than 0. See attachment \n\nI tested with Centos 6.x,  Nginx 1.0.15 and Git 2.2.0-rc3 and Git 2.1.3\n\nI hope you understand me and I don´t talk nonsense. My English a little rusty and this is my first bug report for open source project :-)  \n\nBest regards\nStephan Springer\n__________________________________________\n\nSLOMAN NEPTUN Schiffahrts-Aktiengesellschaft\nLangenstr. 44, 28195 Bremen / Germany\nTelephone: ++49 (0) 421 1763 - 291\nTelefax:   ++49 (0) 421 1763 - 400\nE-Mail: springer@sloman-neptun.com\nPage: www.sloman-neptun.com\n\nRegistergericht/Registered office: Amtsgericht Bremen (HRB 4046)\nVorsitzender des Aufsichtsrats/Chairman of the Supervisory Board: Fritz Lütke-Uhlenbrock\nVorstand / Board of Managing Directors: Sven-Michael Edye, Dirk Lohmann  \n__________________________________________\n\n\n\nhttps://github.com/git/git/blob/master/http-backend.c\n\nstatic void http_config(void)\n{\n        int i, value = 0;\n        struct strbuf var = STRBUF_INIT;\n\n        git_config_get_bool(\"http.getanyfile\", &getanyfile);\n\n        for (i = 0; i < ARRAY_SIZE(rpc_service); i++) {\n               struct rpc_service *svc = &rpc_service[i];\n               strbuf_addf(&var, \"http.%s\", svc->config_name);\n               if (!git_config_get_bool(var.buf, &value))\n                       svc->enabled = value;  <#### 1 or 0 \n               strbuf_reset(&var);\n        }\n\n        strbuf_release(&var);\n}\n\nstatic struct rpc_service *select_service(const char *name)\n{\n        const char *svc_name;\n        struct rpc_service *svc = NULL;\n        int i;\n\n        if (!skip_prefix(name, \"git-\", &svc_name))\n               forbidden(\"Unsupported service: '%s'\", name);\n\n        for (i = 0; i < ARRAY_SIZE(rpc_service); i++) {\n               struct rpc_service *s = &rpc_service[i];\n               if (!strcmp(s->name, svc_name)) {\n                       svc = s;\n                       break;\n               }\n        }\n\n        if (!svc)\n               forbidden(\"Unsupported service: '%s'\", name);\n\n        #\n        # better (svc->enabled <= 0) than can �REMOTE_USER� enable push function \n        #\n        if (svc->enabled < 0) {        \n               const char *user = getenv(\"REMOTE_USER\");\n               svc->enabled = (user && *user) ? 1 : 0;\n        }\n        if (!svc->enabled)\n               forbidden(\"Service not enabled: '%s'\", svc->name);\n        return svc;\n}\n"},{"id":"252488","messageId":"20141125035618.GA19301@peff.net","threadId":"38034","inReplyTo":"F9AF62ADACFFBA47BEEADC5C12509F3401226EE8F8@Hermes.sns.local","subject":"Re: BUG in http-backend.c > http.receivepack","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2014-11-25T03:56:19Z","receivedAt":"2014-11-25T03:56:19Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Mon, Nov 24, 2014 at 09:18:52AM +0100, Springer, Stephan wrote:\n\n> I found bug in http-backend.c with config-flag \"http.receivepack\"  You\n> describe in our documentation: \"This serves git send-pack clients,\n> allowing push. It is disabled by default for anonymous users, and\n> enabled by default for users authenticated by the web server. It can\n> be disabled by setting this item to false, or enabled for all users,\n> including anonymous users, by setting it to true.\"\n> That cannot work, while svc-enable less than 0. See attachment\n\nSorry, I don't quite understand. The \"enabled\" field is one of:\n\n  -1: we allow access if $REMOTE_USER is set, and otherwise not\n   0: we never allow access\n   1: we always allow access\n\nThe default is -1. By setting it to \"true\" or \"false\" you get 1 or 0,\nrespectively. You cannot explicitly ask for the default, except by not\nsetting the value in the first place.\n\n>         #\n>         # better (svc->enabled <= 0) than can ?REMOTE_USER? enable push function \n>         #\n>         if (svc->enabled < 0) {        \n>                const char *user = getenv(\"REMOTE_USER\");\n>                svc->enabled = (user && *user) ? 1 : 0;\n>         }\n\nIf this condition were \"svc->enabled <= 0\", then setting the config\noption to \"false\", which should turn off access, will respect\n$REMOTE_USER instead. That is not right.\n\nCan you describe what you're configuring and running, what behavior you\nexpect, and what you get instead?\n\n-Peff\n"}]}