[PATCH/resend] CVS Server: Support reading base and roots from environment
- From
Phil Miller <mille121@illinois.edu>
- Date
- Nov 20, 2009, 16:05 UTC
- Message-ID
- <81f018ac0911200805g55bd1607u651334c1ed7f1303@mail.gmail.com>
The Gitosis single-account Git/ssh hosting system runs git commands through git-shell after confirming that the connecting user is authorized to access the requested repository. This works well for upload-pack and receive-pack, which take a repository argument through git-shell. This doesn't work so well for `cvs server', which is passed through literally, with no arguments. Allowing arguments risks sneaking in `--export-all', so that restriction should be maintained.
Despite that, passing a list of repository roots is necessary for per-user access control by the hosting software, and passing a base path improves usability without weakening security. Thus, git-cvsserver needs to come up with these values at runtime by some other means. Since git-shell preserves the environment for other purposes, the environment can carry these arguments as well.
Thus, modify git-cvsserver to read $GIT_CVSSERVER_{BASE_PATH,ROOTS} in the absence of equivalent command line arguments.
Signed-off-by: Phil Miller <mille121@illinois.edu> --- git-cvsserver.perl | 21 ++++++++++++++++++++- 1 files changed, 20 insertions(+), 1 deletions(-)
diff --git a/git-cvsserver.perl b/git-cvsserver.perl index 6dc45f5..9e58d2a 100755 --- a/git-cvsserver.perl +++ b/git-cvsserver.perl @@ -104,6 +104,7 @@ $log->info("--------------- STARTING -----------------"); my $usage = "Usage: git cvsserver [options] [pserver|server] [<directory> ...]\n". " --base-path <path> : Prepend to requested CVSROOT\n". + " Can be read from GIT_CVSSERVER_BASE_PATH\n". " --strict-paths : Don't allow recursing into subdirectories\n". " --export-all : Don't check for gitcvs.enabled in config\n". " --version, -V : Print version information and exit\n". @@ -111,7 +112,8 @@ my $usage = "\n". "<directory> ... is a list of allowed directories. If no directories\n". "are given, all are allowed. This is an additional restriction, gitcvs\n". - "access still needs to be enabled by the gitcvs.enabled config option.\n"; + "access still needs to be enabled by the gitcvs.enabled config option.\n". + "Alternately, these directories may be specified in GIT_CVSSERVER_ROOTS.\n"; my @opts = ( 'help|h|H', 'version|V', 'base-path=s', 'strict-paths', 'export-all' ); @@ -148,6 +150,23 @@ if ($state->{'export-all'} && !@{$state->{allowed_roots}}) { die "--export-all can only be used together with an explicit whitelist\n"; } +# Environment handling for running under git-shell +if ($ENV{GIT_CVSSERVER_BASE_PATH}) { + if ($state->{'base-path'}) { + die "Cannot specify base path both ways.\n"; + } + my $base_path = $ENV{GIT_CVSSERVER_BASE_PATH}; + $state->{'base-path'} = $base_path; + $log->debug("Picked up base path '$base_path' from environment.\n"); +} +if ($ENV{GIT_CVSSERVER_ROOTS}) { + if (@{$state->{allowed_roots}}) { + die "Cannot specify roots both ways: @ARGV\n"; + } + my @allowed_root = split(',', $ENV{GIT_CVSSERVER_ROOTS}); + $state->{allowed_roots} = [ @allowed_root ]; +} + # if we are called with a pserver argument, # deal with the authentication cat before entering the # main loop
-- 1.5.6.3