Re: [RFC PATCH] gitweb: Support filtering projects by .htaccess files.
- From
Alexander Gavrilov <angavrilov@gmail.com>
- Date
- Nov 6, 2008, 19:43 UTC
- Message-ID
- <200811062243.27348.angavrilov@gmail.com>
- In-Reply-To
- <200811060026.59340.jnareb@gmail.com>
On Thursday 06 November 2008 02:26:58 Jakub Narebski wrote:
Show 17 quoted lines
> Alexander Gavrilov wrote:
> > + For example, if you use mod_perl to run the script, and have dumb
> > + http protocol authentication configured for your repositories, you
> > + can use the following hook to allow access only if the user is
> > + authorized to read the files:
> > +
> > + $export_auth_hook = sub {
> > + use Apache2::SubRequest ();
> > + use Apache2::Const -compile => qw(HTTP_OK);
> > + my $path = "$_[0]/HEAD";
> > + my $r = Apache2::RequestUtil->request;
> > + my $sub = $r->lookup_file($path);
> > + return $sub->filename eq $path
> > + && $sub->status == Apache2::Const::HTTP_OK;
> > + };
>
> Can anybody check this? Or was it checked by author?Well, it seems to do what is intended on my home server, although it has a known limitation, so here is an updated version that warns about it.
By the way, do you know how to deal with Apache or ModPerl's urge to append standard error messages to the script output, other than adding a bunch of lines like the following to the config?
ErrorMessage 400 " "
I couldn't find any solutions so far.
--- >8 --- Subject: [PATCH] gitweb: Add a per-repository authorization hook.
Add a configuration variable that can be used to specify an arbitrary subroutine that will be called in the same situations where $export_ok is checked, and its return value will be used to decide whether the repository is to be shown.
This allows the user to implement custom authentication schemes, for example by issuing a subrequest through mod_perl and checking if Apache will authorize it.
Signed-off-by: Alexander Gavrilov <angavrilov@gmail.com> --- gitweb/INSTALL | 23 +++++++++++++++++++++++ gitweb/gitweb.perl | 8 +++++++- 2 files changed, 30 insertions(+), 1 deletions(-)
diff --git a/gitweb/INSTALL b/gitweb/INSTALL index 26967e2..72a1322 100644 --- a/gitweb/INSTALL +++ b/gitweb/INSTALL @@ -166,6 +166,29 @@ Gitweb repositories shows repositories only if this file exists in its object database (if directory has the magic file named $export_ok). +- Finally, it is possible to specify an arbitrary perl subroutine that + will be called for each project to determine if it can be exported. + The subroutine receives an absolute path to the project as its only + parameter. + + For example, if you use mod_perl to run the script, and have dumb + http protocol authentication configured for your repositories, you + can use the following hook to allow access only if the user is + authorized to read the files: + + $export_auth_hook = sub { + use Apache2::SubRequest (); + use Apache2::Const -compile => qw(HTTP_OK); + my $path = "$_[0]/HEAD"; + my $r = Apache2::RequestUtil->request; + my $sub = $r->lookup_file($path); + return $sub->filename eq $path + && $sub->status == Apache2::Const::HTTP_OK; + }; + + Note that since this sample works exclusively in the filesystem + namespace, <Location> sections of the configuration have no effect. + Generating projects list using gitweb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl index 172ea6b..9329880 100755 --- a/gitweb/gitweb.perl +++ b/gitweb/gitweb.perl @@ -95,6 +95,11 @@ our $default_projects_order = "project"; # (only effective if this variable evaluates to true) our $export_ok = "++GITWEB_EXPORT_OK++"; +# show repository only if this subroutine returns true +# when given the path to the project, for example: +# sub { return -e "$_[0]/git-daemon-export-ok"; } +our $export_auth_hook = undef; + # only allow viewing of repositories also shown on the overview page our $strict_export = "++GITWEB_STRICT_EXPORT++"; @@ -400,7 +405,8 @@ sub check_head_link { sub check_export_ok { my ($dir) = @_; return (check_head_link($dir) && - (!$export_ok || -e "$dir/$export_ok")); + (!$export_ok || -e "$dir/$export_ok") && + (!$export_auth_hook || $export_auth_hook->($dir))); } # process alternate names for backward compatibility
-- tg: (0d4f9de..) t/authenticate/hook (depends on: t/authenticate/unify-exportok)