Re: BUG in http-backend.c > http.receivepack

From: Jeff King <peff@peff.net>
Date: Nov 25, 2014, 03:56 UTC
Message-ID: <20141125035618.GA19301@peff.net>
In-Reply-To: <F9AF62ADACFFBA47BEEADC5C12509F3401226EE8F8@Hermes.sns.local>

On Mon, Nov 24, 2014 at 09:18:52AM +0100, Springer, Stephan wrote:

Show 7 quoted lines

> I found bug in http-backend.c with config-flag "http.receivepack"  You
> describe in our documentation: "This serves git send-pack clients,
> allowing push. It is disabled by default for anonymous users, and
> enabled by default for users authenticated by the web server. It can
> be disabled by setting this item to false, or enabled for all users,
> including anonymous users, by setting it to true."
> That cannot work, while svc-enable less than 0. See attachment

Sorry, I don't quite understand. The "enabled" field is one of:

  -1: we allow access if $REMOTE_USER is set, and otherwise not
   0: we never allow access
   1: we always allow access

The default is -1. By setting it to "true" or "false" you get 1 or 0, respectively. You cannot explicitly ask for the default, except by not setting the value in the first place.

Show 7 quoted lines

>         #
>         # better (svc->enabled <= 0) than can ?REMOTE_USER? enable push function 
>         #
>         if (svc->enabled < 0) {        
>                const char *user = getenv("REMOTE_USER");
>                svc->enabled = (user && *user) ? 1 : 0;
>         }

If this condition were "svc->enabled <= 0", then setting the config option to "false", which should turn off access, will respect $REMOTE_USER instead. That is not right.

Can you describe what you're configuring and running, what behavior you expect, and what you get instead?

-Peff