gitweb bug: Existence if hidden repositories is leaked

Hi list,

I am using gitweb, git-daemon and gitolite on my Debian Squeeze server. I have some repositories however that I do not want to be available to the public (currently, that is gitolite-admin only). Those repositories do not have a "git-daemon-export-ok" file, and the gitweb config contains

# path to git projects (<project>.git) $projectroot = "/home/git/repositories"; # only show repos which allow daemon access $export_ok = "git-daemon-export-ok";

I am also using pathinfo to get prettier URLs. However, if I now try to access gitolite-admin.git in the browser, I get "404 Project Not Found". If I try to access some repository which dos not actually exist, I am redirected to the project index. This way, the existence of hidden repositories is disclosed.

The problem is in the function evaluate_path_info which uses check_head_link to find out which part of the URL is the project. Replacing this by check_export_ok fixes the problem.

Kind regards, Ralf

PS: Please keep me in CC, I am not subscribed.