# Separately repository access in GitWeb

2 messages from 2013-01-25 to 2013-01-25. Participants: Андрей Баранов.
Thread: https://gitlist.dev/t/32721

## Андрей Баранов, 2013-01-25 08:10

Subject: Separately repository access in GitWeb
Message-ID: <CAJjU7bS-rRr-UuEA_xcqtTY4+tWKshL+Rvey85n70KacSnTorQ@mail.gmail.com>
URL: https://gitlist.dev/e/CAJjU7bS-rRr-UuEA_xcqtTY4%2BtWKshL%2BRvey85n70KacSnTorQ%40mail.gmail.com

```
good day.

I`m trying make separately repository access in GitWeb by NGINX

separation of access based on URL strings, namely, the presence of the
query strings:
'?p=repo.git'
with a regular expression:
"^.*p=(.*?)(\.git|;|&|=|\s).*$"

I am wondering how much it is correct to protect against unauthorized access.

Thanks in advance :)

complete example of a configuration file:

server {
        listen 80;

root /home/git/gitweb;

        access_log /var/log/nginx/gitweb.access_log main;
        error_log /var/log/nginx/gitweb.error_log info;

        index gitweb.cgi;
gzip off;

    location ~* \.(jpg|txt|jpeg|gif|png|ico|css|zip|js|swf)$ {
access_log        off;
        expires 1d;
    }

    location = / {
set $htpasswd "opened@";
if ($args ~* "^.*p=(.*?)(\.git|;|&|=|\s).*$") {
set $htpasswd /home/git/.gitolite/conf/$1_htpasswd;
        }
        if (-f $htpasswd) {
                rewrite ^.*$  /closed last;
        }

rewrite ^.*$ /guest last;
    }

    location = /closed {
internal;
access_log /var/log/nginx/gitweb-closed.access_log main;
auth_basic "Unauthorized";
        auth_basic_user_file $htpasswd;
        include fastcgi_params;
        fastcgi_param  SCRIPT_NAME gitweb.cgi;
        fastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;
        fastcgi_pass unix:/var/run/fcgiwrap.socket;
    }

    location = /guest {
internal;
access_log /var/log/nginx/gitweb-guest.access_log main;
        include fastcgi_params;
fastcgi_param  SCRIPT_NAME gitweb.cgi;
fastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;
        fastcgi_pass unix:/var/run/fcgiwrap.socket;
    }

    location  / {
        rewrite (.*) / permanent;
    }

}

```

## Андрей Баранов, 2013-01-25 09:00

Subject: Fwd: Separately repository access in GitWeb
Message-ID: <CAJjU7bQ65q_oznTV57oMM4XPkHrEUwZ-TZ4UzRHp=k7VkfMDGg@mail.gmail.com>
URL: https://gitlist.dev/e/CAJjU7bQ65q_oznTV57oMM4XPkHrEUwZ-TZ4UzRHp%3Dk7VkfMDGg%40mail.gmail.com
In-Reply-To: <CAJjU7bS-rRr-UuEA_xcqtTY4+tWKshL+Rvey85n70KacSnTorQ@mail.gmail.com>

```
good day.

I`m trying make separately repository access in GitWeb by NGINX

separation of access based on URL strings, namely, the presence of the
query strings:
'?p=repo.git'
with a regular expression:
"^.*p=(.*?)(\.git|;|&|=|\s).*$"

I am wondering how much it is correct to protect against unauthorized access.

Thanks in advance :)

complete example of a configuration file:

server {
        listen 80;

root /home/git/gitweb;

        access_log /var/log/nginx/gitweb.access_log main;
        error_log /var/log/nginx/gitweb.error_log info;

        index gitweb.cgi;
gzip off;

    location ~* \.(jpg|txt|jpeg|gif|png|ico|css|zip|js|swf)$ {
access_log        off;
        expires 1d;
    }

    location = / {
set $htpasswd "opened@";
if ($args ~* "^.*p=(.*?)(\.git|;|&|=|\s).*$") {
set $htpasswd /home/git/.gitolite/conf/$1_htpasswd;
        }
        if (-f $htpasswd) {
                rewrite ^.*$  /closed last;
        }

rewrite ^.*$ /guest last;
    }

    location = /closed {
internal;
access_log /var/log/nginx/gitweb-closed.access_log main;
auth_basic "Unauthorized";
        auth_basic_user_file $htpasswd;
        include fastcgi_params;
        fastcgi_param  SCRIPT_NAME gitweb.cgi;
        fastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;
        fastcgi_pass unix:/var/run/fcgiwrap.socket;
    }

    location = /guest {
internal;
access_log /var/log/nginx/gitweb-guest.access_log main;
        include fastcgi_params;
fastcgi_param  SCRIPT_NAME gitweb.cgi;
fastcgi_param SCRIPT_FILENAME /home/git/gitweb/gitweb.cgi;
        fastcgi_pass unix:/var/run/fcgiwrap.socket;
    }

    location  / {
        rewrite (.*) / permanent;
    }

}

```