threads / patch / 5578

patchgitweb: export-ok option

Subject: [PATCH] gitweb: export-ok option

## tl;dr

15 messages between Sep 16, 2006 and Sep 17, 2006. Diffs are folded; open one to read it.

replies: 14people: 3as markdown or json

Matthias Lederhofer· Sep 16, 2006, 19:27 UTC · lore

Similar to git-daemon checking for git-daemon-export-ok this introduces an optional check before showing a repository in gitweb.

I also changed the 'No such directory' error message to 'No such project' because the user visiting my gitweb should not know what directories I have in the project root directory.

undef $project; is used to prevent displaying the description.
---
Perhaps there should be another option which allows only those
repositories to be shown which are in $projects_list.
---
 Makefile           |    2 ++
 gitweb/gitweb.perl |   18 ++++++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)
Show changes to 2 files +14 −6

Makefile, gitweb/gitweb.perl

diff --git a/Makefile b/Makefile
index 7b3114f..63df24c 100644
--- a/Makefile
+++ b/Makefile
@@ -132,6 +132,7 @@ GITWEB_HOMETEXT = indextext.html
 GITWEB_CSS = gitweb.css
 GITWEB_LOGO = git-logo.png
 GITWEB_FAVICON = git-favicon.png
+GITWEB_EXPORT_OK =
 
 export prefix bindir gitexecdir template_dir GIT_PYTHON_DIR
 
@@ -637,6 +638,7 @@ gitweb/gitweb.cgi: gitweb/gitweb.perl
 	    -e 's|++GITWEB_CSS++|$(GITWEB_CSS)|g' \
 	    -e 's|++GITWEB_LOGO++|$(GITWEB_LOGO)|g' \
 	    -e 's|++GITWEB_FAVICON++|$(GITWEB_FAVICON)|g' \
+	    -e 's|++GITWEB_EXPORT_OK++|$(GITWEB_EXPORT_OK)|g' \
 	    $< >$@+
 	chmod +x $@+
 	mv $@+ $@
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index d89f709..3944d13 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -54,6 +54,9 @@ our $favicon = "++GITWEB_FAVICON++";
 # source of projects list
 our $projects_list = "++GITWEB_LIST++";
 
+# show repository only if this file exists
+our $export_ok = "++GITWEB_EXPORT_OK++";
+
 # list of git base URLs used for URL to where fetch project from,
 # i.e. full URL is "$git_base_url/$project"
 our @git_base_url_list = ("++GITWEB_BASE_URL++");
@@ -181,12 +184,13 @@ if (defined $project) {
 }
 if (defined $project) {
 	if (!validate_input($project)) {
+		undef $project;
 		die_error(undef, "Invalid project parameter");
 	}
-	if (!(-d "$projectroot/$project")) {
-		die_error(undef, "No such directory");
-	}
-	if (!(-e "$projectroot/$project/HEAD")) {
+	if (!(-d "$projectroot/$project") ||
+	    !(-e "$projectroot/$project/HEAD") ||
+	    ($export_ok && !(-e "$projectroot/$project/$export_ok"))) {
+		undef $project;
 		die_error(undef, "No such project");
 	}
 	$git_dir = "$projectroot/$project";
@@ -694,7 +698,8 @@ sub git_get_projects_list {
 		my $dir = $projects_list;
 		opendir my ($dh), $dir or return undef;
 		while (my $dir = readdir($dh)) {
-			if (-e "$projectroot/$dir/HEAD") {
+			if (-e "$projectroot/$dir/HEAD" && (!$export_ok ||
+			    -e "$projectroot/$dir/$export_ok")) {
 				my $pr = {
 					path => $dir,
 				};
@@ -716,7 +721,8 @@ sub git_get_projects_list {
 			if (!defined $path) {
 				next;
 			}
-			if (-e "$projectroot/$path/HEAD") {
+			if (-e "$projectroot/$path/HEAD" && (!$export_ok ||
+			    -e "$projectroot/$path/$export_ok")) {
 				my $pr = {
 					path => $path,
 					owner => decode("utf8", $owner, Encode::FB_DEFAULT),

-- 
1.4.2.g0ea2
Jakub Narebski· Sep 16, 2006, 19:40 UTC · re: Matthias Lederhofer · lore

Re: [PATCH] gitweb: export-ok option

Matthias Lederhofer wrote:
> Perhaps there should be another option which allows only those
> repositories to be shown which are in $projects_list.

If $projects_list is a file (and not directory), only repositories specified there are shown.

-- 
Jakub Narebski
Warsaw, Poland
ShadeHawk on #git
Matthias Lederhofer· Sep 16, 2006, 20:33 UTC · re: Jakub Narebski · lore

Re: [PATCH] gitweb: export-ok option

Jakub Narebski <jnareb@gmail.com> wrote:
Show 7 quoted lines
> Matthias Lederhofer wrote:
> 
> > Perhaps there should be another option which allows only those
> > repositories to be shown which are in $projects_list.
> 
> If $projects_list is a file (and not directory), only repositories
> specified there are shown.

The main problem is not the list of projects. Every repository below $project_root can be viewed using ?p=path/to/repostory.

Junio C Hamano· Sep 16, 2006, 20:37 UTC · re: Jakub Narebski · lore

Re: [PATCH] gitweb: export-ok option

Jakub Narebski <jnareb@gmail.com> writes:
Show 7 quoted lines
> Matthias Lederhofer wrote:
>
>> Perhaps there should be another option which allows only those
>> repositories to be shown which are in $projects_list.
>
> If $projects_list is a file (and not directory), only repositories
> specified there are shown.

If you can _guess_ project's name, you can go directly to git_summary with it, and the page (or links that the page leads to) does not check $projects_list at all, no?

I think Matthias's patch addresses that issue.
Jakub Narebski· Sep 16, 2006, 19:44 UTC · re: Matthias Lederhofer · lore

Re: [PATCH] gitweb: export-ok option

Matthias Lederhofer wrote:
Show 11 quoted lines
> Similar to git-daemon checking for git-daemon-export-ok this
> introduces an optional check before showing a repository in gitweb.
> 
> I also changed the 'No such directory' error message to 'No such
> project' because the user visiting my gitweb should not know what
> directories I have in the project root directory.
> 
> undef $project; is used to prevent displaying the description.
> ---
> Perhaps there should be another option which allows only those
> repositories to be shown which are in $projects_list.

I don't know what this is for (well, except replacing 'No such directory' error message by 'No such project'). If you want only some of repositories to be present in gitweb, you simply use $projects_list _file_ (e.g. using new "project_index" action to generate it) and edit it to contain only the repositories you want to be shown in gitweb.

Unless of course the person who hosts gitweb, and the person who owns repository are uncommunicado, and you want the power of deciding if repository is present in gitweb or not to be placed in the hands of repository owner. Still, gitweb must be configured for this.

-- 
Jakub Narebski
Warsaw, Poland
ShadeHawk on #git
Matthias Lederhofer· Sep 16, 2006, 21:43 UTC · re: Matthias Lederhofer · lore

[PATCH] gitweb: option 'strict export'

With this option enabled gitweb will only give access to repositories which are also shown on the overview page. --- Matthias Lederhofer <matled@gmx.net> wrote:

> Perhaps there should be another option which allows only those
> repositories to be shown which are in $projects_list.
Here it is.  This option is probably the one more likely to be used.
It disallows access to repositories (using ?p=path/to/repository) that
are not on the projects-list-page.
---
 Makefile           |    2 ++
 gitweb/gitweb.perl |   12 +++++++++++-
 2 files changed, 13 insertions(+), 1 deletions(-)
Show changes to 2 files +13 −1

Makefile, gitweb/gitweb.perl

diff --git a/Makefile b/Makefile
index 63df24c..0e17d4c 100644
--- a/Makefile
+++ b/Makefile
@@ -133,6 +133,7 @@ GITWEB_CSS = gitweb.css
 GITWEB_LOGO = git-logo.png
 GITWEB_FAVICON = git-favicon.png
 GITWEB_EXPORT_OK =
+GITWEB_STRICT_EXPORT =
 
 export prefix bindir gitexecdir template_dir GIT_PYTHON_DIR
 
@@ -639,6 +640,7 @@ gitweb/gitweb.cgi: gitweb/gitweb.perl
 	    -e 's|++GITWEB_LOGO++|$(GITWEB_LOGO)|g' \
 	    -e 's|++GITWEB_FAVICON++|$(GITWEB_FAVICON)|g' \
 	    -e 's|++GITWEB_EXPORT_OK++|$(GITWEB_EXPORT_OK)|g' \
+	    -e 's|++GITWEB_STRICT_EXPORT++|$(GITWEB_STRICT_EXPORT)|g' \
 	    $< >$@+
 	chmod +x $@+
 	mv $@+ $@
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 3944d13..976f7ec 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -57,6 +57,9 @@ our $projects_list = "++GITWEB_LIST++";
 # show repository only if this file exists
 our $export_ok = "++GITWEB_EXPORT_OK++";
 
+# only allow viewing of repositories also shown on the overview page
+our $strict_export = "++GITWEB_STRICT_EXPORT++";
+
 # list of git base URLs used for URL to where fetch project from,
 # i.e. full URL is "$git_base_url/$project"
 our @git_base_url_list = ("++GITWEB_BASE_URL++");
@@ -189,7 +192,8 @@ if (defined $project) {
 	}
 	if (!(-d "$projectroot/$project") ||
 	    !(-e "$projectroot/$project/HEAD") ||
-	    ($export_ok && !(-e "$projectroot/$project/$export_ok"))) {
+	    ($export_ok && !(-e "$projectroot/$project/$export_ok")) ||
+	    ($strict_export && !project_in_list($project))) {
 		undef $project;
 		die_error(undef, "No such project");
 	}
@@ -384,6 +388,12 @@ sub untabify {
 	return $line;
 }
 
+sub project_in_list {
+	my $project = shift;
+	my @list = git_get_projects_list();
+	return(@list && scalar(grep { $_->{'path'} eq $project } @list) != 0);
+}
+
 ## ----------------------------------------------------------------------
 ## HTML aware string manipulation
 

-- 
1.4.2.g0ea2
Matthias Lederhofer· Sep 16, 2006, 22:30 UTC · re: Matthias Lederhofer · lore

[PATCH/current master] gitweb: do not use 'No such directory' error message

undef $project; to prevent a file named description to be read.
---
Sorry, I patched an old version.  Here is the patch for the current
master/next.
---
 gitweb/gitweb.perl |   11 ++++-------
 1 files changed, 4 insertions(+), 7 deletions(-)
Show changes to gitweb/gitweb.perl +4 −7
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index a81c8d4..07ea1ea 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -203,13 +203,10 @@ if (defined $project) {
 	$project = undef unless $project;
 }
 if (defined $project) {
-	if (!validate_input($project)) {
-		die_error(undef, "Invalid project parameter");
-	}
-	if (!(-d "$projectroot/$project")) {
-		die_error(undef, "No such directory");
-	}
-	if (!(-e "$projectroot/$project/HEAD")) {
+	if (!validate_input($project) ||
+	    !(-d "$projectroot/$project") ||
+	    !(-e "$projectroot/$project/HEAD")) {
+		undef $project;
 		die_error(undef, "No such project");
 	}
 	$git_dir = "$projectroot/$project";

-- 
1.4.2.g0ea2
Matthias Lederhofer· Sep 16, 2006, 22:31 UTC · re: Matthias Lederhofer · lore

[PATCH] gitweb: export options

$export_ok: If this variable evaluates to true it is checked if a file with this name exists in the repository. If it does not exist the repository cannot be viewed from gitweb. (Similar to git-daemon-export-ok for git-daemon).

$strict_export: If this variable evaluates to true only
repositories listed on the project-list-page of gitweb can
be accessed.
---
 Makefile           |    4 ++++
 gitweb/gitweb.perl |   23 ++++++++++++++++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)
Show changes to 2 files +24 −3

Makefile, gitweb/gitweb.perl

diff --git a/Makefile b/Makefile
index 7b3114f..b9938ac 100644
--- a/Makefile
+++ b/Makefile
@@ -126,6 +126,8 @@ GITWEB_CONFIG = gitweb_config.perl
 GITWEB_HOME_LINK_STR = projects
 GITWEB_SITENAME =
 GITWEB_PROJECTROOT = /pub/git
+GITWEB_EXPORT_OK =
+GITWEB_STRICT_EXPORT =
 GITWEB_BASE_URL =
 GITWEB_LIST =
 GITWEB_HOMETEXT = indextext.html
@@ -631,6 +633,8 @@ gitweb/gitweb.cgi: gitweb/gitweb.perl
 	    -e 's|++GITWEB_HOME_LINK_STR++|$(GITWEB_HOME_LINK_STR)|g' \
 	    -e 's|++GITWEB_SITENAME++|$(GITWEB_SITENAME)|g' \
 	    -e 's|++GITWEB_PROJECTROOT++|$(GITWEB_PROJECTROOT)|g' \
+	    -e 's|++GITWEB_EXPORT_OK++|$(GITWEB_EXPORT_OK)|g' \
+	    -e 's|++GITWEB_STRICT_EXPORT++|$(GITWEB_STRICT_EXPORT)|g' \
 	    -e 's|++GITWEB_BASE_URL++|$(GITWEB_BASE_URL)|g' \
 	    -e 's|++GITWEB_LIST++|$(GITWEB_LIST)|g' \
 	    -e 's|++GITWEB_HOMETEXT++|$(GITWEB_HOMETEXT)|g' \
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 07ea1ea..2a63c17 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -54,6 +54,13 @@ our $favicon = "++GITWEB_FAVICON++";
 # source of projects list
 our $projects_list = "++GITWEB_LIST++";
 
+# show repository only if this file exists
+# (only effective if this variable evaluates to true)
+our $export_ok = "++GITWEB_EXPORT_OK++";
+
+# only allow viewing of repositories also shown on the overview page
+our $strict_export = "++GITWEB_STRICT_EXPORT++";
+
 # list of git base URLs used for URL to where fetch project from,
 # i.e. full URL is "$git_base_url/$project"
 our @git_base_url_list = ("++GITWEB_BASE_URL++");
@@ -205,7 +212,9 @@ if (defined $project) {
 if (defined $project) {
 	if (!validate_input($project) ||
 	    !(-d "$projectroot/$project") ||
-	    !(-e "$projectroot/$project/HEAD")) {
+	    !(-e "$projectroot/$project/HEAD") ||
+	    ($export_ok && !(-e "$projectroot/$project/$export_ok")) ||
+	    ($strict_export && !project_in_list($project))) {
 		undef $project;
 		die_error(undef, "No such project");
 	}
@@ -402,6 +411,12 @@ sub untabify {
 	return $line;
 }
 
+sub project_in_list {
+	my $project = shift;
+	my @list = git_get_projects_list();
+	return @list && scalar(grep { $_->{'path'} eq $project } @list);
+}
+
 ## ----------------------------------------------------------------------
 ## HTML aware string manipulation
 
@@ -714,7 +729,8 @@ sub git_get_projects_list {
 
 				my $subdir = substr($File::Find::name, $pfxlen + 1);
 				# we check related file in $projectroot
-				if (-e "$projectroot/$subdir/HEAD") {
+				if (-e "$projectroot/$subdir/HEAD" && (!$export_ok ||
+				    -e "$projectroot/$subdir/$export_ok")) {
 					push @list, { path => $subdir };
 					$File::Find::prune = 1;
 				}
@@ -735,7 +751,8 @@ sub git_get_projects_list {
 			if (!defined $path) {
 				next;
 			}
-			if (-e "$projectroot/$path/HEAD") {
+			if (-e "$projectroot/$path/HEAD" && (!$export_ok ||
+			    -e "$projectroot/$path/$export_ok")) {
 				my $pr = {
 					path => $path,
 					owner => decode("utf8", $owner, Encode::FB_DEFAULT),

-- 
1.4.2.g0ea2
Junio C Hamano· Sep 17, 2006, 08:53 UTC · re: Matthias Lederhofer · lore

Re: [PATCH] gitweb: export options

Matthias Lederhofer <matled@gmx.net> writes:
Show 8 quoted lines
> $export_ok: If this variable evaluates to true it is checked
> if a file with this name exists in the repository.  If it
> does not exist the repository cannot be viewed from gitweb.
> (Similar to git-daemon-export-ok for git-daemon).
>
> $strict_export: If this variable evaluates to true only
> repositories listed on the project-list-page of gitweb can
> be accessed.
Is this replacement for your earlier two patches?
        [PATCH] gitweb: export-ok option
        [PATCH] gitweb: option 'strict export'
What's the difference between this and the previous two?

I am asking this question because I am lazy and do not want to review two sets of similar patches ;-).

Matthias Lederhofer· Sep 17, 2006, 09:07 UTC · re: Junio C Hamano · lore

Re: [PATCH] gitweb: export options

Junio C Hamano <junkio@cox.net> wrote:
> Matthias Lederhofer <matled@gmx.net> writes:
> Is this replacement for your earlier two patches?

Yes, it is, they did not apply on the current master. (I fetched the new heads, had a short look at the log but forgot to update my working heads :) ).

>         [PATCH] gitweb: export-ok option
>         [PATCH] gitweb: option 'strict export'
> 
> What's the difference between this and the previous two?

Now I decided to split it in another way: first remove the no-such-directory error and then implement the two new features. The patches should be equivalent to those before.

Junio C Hamano· Sep 17, 2006, 10:34 UTC · re: Matthias Lederhofer · lore

Re: [PATCH] gitweb: export options

Matthias Lederhofer <matled@gmx.net> writes:
Show 15 quoted lines
> Junio C Hamano <junkio@cox.net> wrote:
>> Matthias Lederhofer <matled@gmx.net> writes:
>> Is this replacement for your earlier two patches?
> Yes, it is, they did not apply on the current master. (I fetched the
> new heads, had a short look at the log but forgot to update my working
> heads :) ).
>
>>         [PATCH] gitweb: export-ok option
>>         [PATCH] gitweb: option 'strict export'
>> 
>> What's the difference between this and the previous two?
>
> Now I decided to split it in another way: first remove the
> no-such-directory error and then implement the two new features. The
> patches should be equivalent to those before.
I see.

The PATHINFO stuff Martin Waitz did mucks with $project somewhat later than this part of the patch, possibly bypassing your checks. Could you check what's in 'master' to see if it is reasonable and if not fix it up please?

Matthias Lederhofer· Sep 17, 2006, 13:29 UTC · re: Junio C Hamano · lore

[PATCH] gitweb: fix warnings in PATH_INFO code and add export_ok/strict_export

--- Junio C Hamano <junkio@cox.net> wrote:

Show 5 quoted lines
> Matthias Lederhofer <matled@gmx.net> writes:
> The PATHINFO stuff Martin Waitz did mucks with $project somewhat
> later than this part of the patch, possibly bypassing your
> checks.  Could you check what's in 'master' to see if it is
> reasonable and if not fix it up please?
This patch replaces the other two warning fixes by Jakub and me.  I've
put the whole thing in a sub-routine to keep the indentation level
low.
---
 gitweb/gitweb.perl |   34 +++++++++++++++++++++-------------
 1 files changed, 21 insertions(+), 13 deletions(-)
Show changes to gitweb/gitweb.perl +21 −13
diff --git a/gitweb/gitweb.perl b/gitweb/gitweb.perl
index 497129a..0fb8638 100755
--- a/gitweb/gitweb.perl
+++ b/gitweb/gitweb.perl
@@ -189,9 +189,6 @@ do $GITWEB_CONFIG if -e $GITWEB_CONFIG;
 # version of the core git binary
 our $git_version = qx($GIT --version) =~ m/git version (.*)$/ ? $1 : "unknown";
 
-# path to the current git repository
-our $git_dir;
-
 $projects_list ||= $projectroot;
 
 # ======================================================================
@@ -273,30 +270,41 @@ if (defined $searchtext) {
 }
 
 # now read PATH_INFO and use it as alternative to parameters
-our $path_info = $ENV{"PATH_INFO"};
-$path_info =~ s|^/||;
-$path_info =~ s|/$||;
-if (validate_input($path_info) && !defined $project) {
+sub evaluate_path_info {
+	return if defined $project;
+	my $path_info = $ENV{"PATH_INFO"};
+	return if !$path_info;
+	$path_info =~ s,(^/|/$),,gs;
+	$path_info = validate_input($path_info);
+	return if !$path_info;
 	$project = $path_info;
 	while ($project && !-e "$projectroot/$project/HEAD") {
 		$project =~ s,/*[^/]*$,,;
 	}
-	if (defined $project) {
-		$project = undef unless $project;
+	if (!$project ||
+	    ($export_ok && !-e "$projectroot/$project/$export_ok") ||
+	    ($strict_export && !project_in_list($project))) {
+		undef $project;
+		return;
 	}
+	# do not change any parameters if an action is given using the query string
+	return if $action;
 	if ($path_info =~ m,^$project/([^/]+)/(.+)$,) {
 		# we got "project.git/branch/filename"
 		$action    ||= "blob_plain";
-		$hash_base ||= $1;
-		$file_name ||= $2;
+		$hash_base ||= validate_input($1);
+		$file_name ||= validate_input($2);
 	} elsif ($path_info =~ m,^$project/([^/]+)$,) {
 		# we got "project.git/branch"
 		$action ||= "shortlog";
-		$hash   ||= $1;
+		$hash   ||= validate_input($1);
 	}
 }
+evaluate_path_info();
 
-$git_dir = "$projectroot/$project";
+# path to the current git repository
+our $git_dir;
+$git_dir = "$projectroot/$project" if $project;
 
 # dispatch
 my %actions = (

-- 
1.4.2.1.ge767
Junio C Hamano· Sep 17, 2006, 22:06 UTC · re: Matthias Lederhofer · lore

Re: [PATCH] gitweb: fix warnings in PATH_INFO code and add export_ok/strict_export

Matthias Lederhofer <matled@gmx.net> writes:
> This patch replaces the other two warning fixes by Jakub and me.  I've
> put the whole thing in a sub-routine to keep the indentation level
> low.
Looks much cleaner with this extra sub.

This does not seem have the "colon as a cue that the URL is also talking about a branch", Jakub's summary of the discussion between you two on #git channel. I think that proposal makes sense as well.

Jakub Narebski· Sep 17, 2006, 22:45 UTC · re: Junio C Hamano · lore

Re: [PATCH] gitweb: fix warnings in PATH_INFO code and add export_ok/strict_export

Junio C Hamano wrote:
Show 12 quoted lines
> Matthias Lederhofer <matled@gmx.net> writes:
> 
>> This patch replaces the other two warning fixes by Jakub and me.  I've
>> put the whole thing in a sub-routine to keep the indentation level
>> low.
> 
> Looks much cleaner with this extra sub.
> 
> This does not seem have the "colon as a cue that the URL is also
> talking about a branch", Jakub's summary of the discussion
> between you two on #git channel.  I think that proposal makes
> sense as well.

Well, that is because this patch _predates_ the discussion (and proposal/conclusions). 

-- 
Jakub Narebski
Warsaw, Poland
ShadeHawk on #git
Junio C Hamano· Sep 17, 2006, 23:10 UTC · re: Jakub Narebski · lore

Re: [PATCH] gitweb: fix warnings in PATH_INFO code and add export_ok/strict_export

Jakub Narebski <jnareb@gmail.com> writes:
Show 17 quoted lines
> Junio C Hamano wrote:
>
>> Matthias Lederhofer <matled@gmx.net> writes:
>> 
>>> This patch replaces the other two warning fixes by Jakub and me.  I've
>>> put the whole thing in a sub-routine to keep the indentation level
>>> low.
>> 
>> Looks much cleaner with this extra sub.
>> 
>> This does not seem have the "colon as a cue that the URL is also
>> talking about a branch", Jakub's summary of the discussion
>> between you two on #git channel.  I think that proposal makes
>> sense as well.
>
> Well, that is because this patch _predates_ the discussion 
> (and proposal/conclusions). 
Yup, I know, I was not complaining.

I was saying that I do not oppose to a follow-up patch to add that "colon" stuff.

← back to recent threads