Merge branch 'access' of github.com:gogits/gogs into dev
This commit is contained in:
Unknwon
commit
a6a2f59d1d
3 changed files with 54 additions and 85 deletions
136
cmd/serve.go
136
cmd/serve.go
|
|
@ -21,6 +21,10 @@ import (
|
|||
"github.com/gogits/gogs/modules/uuid"
|
||||
)
|
||||
|
||||
const (
|
||||
_ACCESS_DENIED_MESSAGE = "Repository does not exist or you do not have access"
|
||||
)
|
||||
|
||||
var CmdServ = cli.Command{
|
||||
Name: "serv",
|
||||
Usage: "This command should only be called by SSH shell",
|
||||
|
|
@ -55,68 +59,55 @@ func parseCmd(cmd string) (string, string) {
|
|||
if len(ss) != 2 {
|
||||
return "", ""
|
||||
}
|
||||
|
||||
verb, args := ss[0], ss[1]
|
||||
if verb == "git" {
|
||||
ss = strings.SplitN(args, " ", 2)
|
||||
args = ss[1]
|
||||
verb = fmt.Sprintf("%s %s", verb, ss[0])
|
||||
}
|
||||
return verb, strings.Replace(args, "'/", "'", 1)
|
||||
return ss[0], strings.Replace(ss[1], "'/", "'", 1)
|
||||
}
|
||||
|
||||
var (
|
||||
COMMANDS_READONLY = map[string]models.AccessMode{
|
||||
"git-upload-pack": models.ACCESS_MODE_WRITE,
|
||||
"git upload-pack": models.ACCESS_MODE_WRITE,
|
||||
"git-upload-archive": models.ACCESS_MODE_WRITE,
|
||||
}
|
||||
|
||||
COMMANDS_WRITE = map[string]models.AccessMode{
|
||||
"git-receive-pack": models.ACCESS_MODE_READ,
|
||||
"git receive-pack": models.ACCESS_MODE_READ,
|
||||
COMMANDS = map[string]models.AccessMode{
|
||||
"git-upload-pack": models.ACCESS_MODE_READ,
|
||||
"git upload-pack": models.ACCESS_MODE_READ,
|
||||
"git-upload-archive": models.ACCESS_MODE_READ,
|
||||
"git-receive-pack": models.ACCESS_MODE_WRITE,
|
||||
"git receive-pack": models.ACCESS_MODE_WRITE,
|
||||
}
|
||||
)
|
||||
|
||||
func In(b string, sl map[string]models.AccessMode) bool {
|
||||
_, e := sl[b]
|
||||
return e
|
||||
}
|
||||
|
||||
func runServ(c *cli.Context) {
|
||||
if c.IsSet("config") {
|
||||
setting.CustomConf = c.String("config")
|
||||
}
|
||||
setup("serv.log")
|
||||
|
||||
if len(c.Args()) < 1 {
|
||||
log.GitLogger.Fatal(2, "Not enough arguments")
|
||||
fail := func(userMessage, logMessage string, args ...interface{}) {
|
||||
fmt.Fprintln(os.Stderr, "Gogs: ", userMessage)
|
||||
log.GitLogger.Fatal(2, logMessage, args...)
|
||||
}
|
||||
|
||||
if len(c.Args()) < 1 {
|
||||
fail("Not enough arguments", "Not enough arugments")
|
||||
}
|
||||
|
||||
keys := strings.Split(c.Args()[0], "-")
|
||||
if len(keys) != 2 {
|
||||
println("Gogs: auth file format error")
|
||||
log.GitLogger.Fatal(2, "Invalid auth file format: %s", os.Args[2])
|
||||
fail("key-id format error", "Invalid key id: %s", c.Args()[0])
|
||||
}
|
||||
|
||||
keyId, err := com.StrTo(keys[1]).Int64()
|
||||
if err != nil {
|
||||
println("Gogs: auth file format error")
|
||||
log.GitLogger.Fatal(2, "Invalid auth file format: %v", err)
|
||||
fail("key-id format error", "Invalid key id: %s", err)
|
||||
}
|
||||
|
||||
user, err := models.GetUserByKeyId(keyId)
|
||||
if err != nil {
|
||||
if err == models.ErrUserNotKeyOwner {
|
||||
println("Gogs: you are not the owner of SSH key")
|
||||
log.GitLogger.Fatal(2, "Invalid owner of SSH key: %d", keyId)
|
||||
}
|
||||
println("Gogs: internal error:", err.Error())
|
||||
log.GitLogger.Fatal(2, "Fail to get user by key ID(%d): %v", keyId, err)
|
||||
fail("internal error", "Fail to get user by key ID(%d): %v", keyId, err)
|
||||
}
|
||||
|
||||
cmd := os.Getenv("SSH_ORIGINAL_COMMAND")
|
||||
if cmd == "" {
|
||||
println("Hi", user.Name, "! You've successfully authenticated, but Gogs does not provide shell access.")
|
||||
println("If this is what you do not expect, please log in with password and setup Gogs under another user.")
|
||||
if user.IsAdmin {
|
||||
println("If this is unexpected, please log in with password and setup Gogs under another user.")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
|
|
@ -124,67 +115,47 @@ func runServ(c *cli.Context) {
|
|||
repoPath := strings.Trim(args, "'")
|
||||
rr := strings.SplitN(repoPath, "/", 2)
|
||||
if len(rr) != 2 {
|
||||
println("Gogs: unavailable repository", args)
|
||||
log.GitLogger.Fatal(2, "Unavailable repository: %v", args)
|
||||
fail("Invalid repository path", "Invalide repository path: %v", args)
|
||||
}
|
||||
repoUserName := rr[0]
|
||||
repoName := strings.TrimSuffix(rr[1], ".git")
|
||||
|
||||
isWrite := In(verb, COMMANDS_WRITE)
|
||||
isRead := In(verb, COMMANDS_READONLY)
|
||||
|
||||
repoUser, err := models.GetUserByName(repoUserName)
|
||||
if err != nil {
|
||||
if err == models.ErrUserNotExist {
|
||||
println("Gogs: given repository owner are not registered")
|
||||
log.GitLogger.Fatal(2, "Unregistered owner: %s", repoUserName)
|
||||
fail("Repository owner does not exist", "Unregistered owner: %s", repoUserName)
|
||||
}
|
||||
println("Gogs: internal error:", err.Error())
|
||||
log.GitLogger.Fatal(2, "Fail to get repository owner(%s): %v", repoUserName, err)
|
||||
fail("Internal error", "Fail to get repository owner(%s): %v", repoUserName, err)
|
||||
}
|
||||
|
||||
// Access check.
|
||||
repo, err := models.GetRepositoryByName(repoUser.Id, repoName)
|
||||
if err != nil {
|
||||
if err == models.ErrRepoNotExist {
|
||||
println("Gogs: given repository does not exist")
|
||||
log.GitLogger.Fatal(2, "Repository does not exist: %s/%s", repoUser.Name, repoName)
|
||||
if user.Id == repoUser.Id || repoUser.IsOwnedBy(user.Id) {
|
||||
fail("Repository does not exist", "Repository does not exist: %s/%s", repoUser.Name, repoName)
|
||||
} else {
|
||||
fail(_ACCESS_DENIED_MESSAGE, "Repository does not exist: %s/%s", repoUser.Name, repoName)
|
||||
}
|
||||
println("Gogs: internal error:", err.Error())
|
||||
log.GitLogger.Fatal(2, "Fail to get repository: %v", err)
|
||||
}
|
||||
fail("Internal error", "Fail to get repository: %v", err)
|
||||
}
|
||||
|
||||
switch {
|
||||
case isWrite:
|
||||
has, err := models.HasAccess(user, repo, models.ACCESS_MODE_WRITE)
|
||||
requestedMode, has := COMMANDS[verb]
|
||||
if !has {
|
||||
fail("Unknown git command", "Unknown git command %s", verb)
|
||||
}
|
||||
|
||||
mode, err := models.AccessLevel(user, repo)
|
||||
if err != nil {
|
||||
println("Gogs: internal error:", err.Error())
|
||||
log.GitLogger.Fatal(2, "Fail to check write access:", err)
|
||||
} else if !has {
|
||||
println("You have no right to write this repository")
|
||||
log.GitLogger.Fatal(2, "User %s has no right to write repository %s", user.Name, repoPath)
|
||||
fail("Internal error", "Fail to check access: %v", err)
|
||||
} else if mode < requestedMode {
|
||||
clientMessage := _ACCESS_DENIED_MESSAGE
|
||||
if mode >= models.ACCESS_MODE_READ {
|
||||
clientMessage = "You do not have sufficient authorization for this action"
|
||||
}
|
||||
|
||||
if repo.IsMirror {
|
||||
println("You can't write to a mirror repository")
|
||||
log.GitLogger.Fatal(2, "User %s tried to write to a mirror repository %s", user.Name, repoPath)
|
||||
}
|
||||
case isRead:
|
||||
if !repo.IsPrivate {
|
||||
break
|
||||
}
|
||||
|
||||
has, err := models.HasAccess(user, repo, models.ACCESS_MODE_READ)
|
||||
if err != nil {
|
||||
println("Gogs: internal error:", err.Error())
|
||||
log.GitLogger.Fatal(2, "Fail to check read access:", err)
|
||||
} else if !has {
|
||||
println("You have no right to access this repository")
|
||||
log.GitLogger.Fatal(2, "User %s has no right to read repository %s", user.Name, repoPath)
|
||||
}
|
||||
default:
|
||||
println("Unknown command: " + cmd)
|
||||
return
|
||||
fail(clientMessage,
|
||||
"User %s does not have level %v access to repository %s",
|
||||
user.Name, requestedMode, repoPath)
|
||||
}
|
||||
|
||||
uuid := uuid.NewV4().String()
|
||||
|
|
@ -202,11 +173,10 @@ func runServ(c *cli.Context) {
|
|||
gitcmd.Stdin = os.Stdin
|
||||
gitcmd.Stderr = os.Stderr
|
||||
if err = gitcmd.Run(); err != nil {
|
||||
println("Gogs: internal error:", err.Error())
|
||||
log.GitLogger.Fatal(2, "Fail to execute git command: %v", err)
|
||||
fail("Internal error", "Fail to execute git command: %v", err)
|
||||
}
|
||||
|
||||
if isWrite {
|
||||
if requestedMode == models.ACCESS_MODE_WRITE {
|
||||
tasks, err := models.GetUpdateTasksByUuid(uuid)
|
||||
if err != nil {
|
||||
log.GitLogger.Fatal(2, "GetUpdateTasksByUuid: %v", err)
|
||||
|
|
@ -228,10 +198,10 @@ func runServ(c *cli.Context) {
|
|||
// Update key activity.
|
||||
key, err := models.GetPublicKeyById(keyId)
|
||||
if err != nil {
|
||||
log.GitLogger.Fatal(2, "GetPublicKeyById: %v", err)
|
||||
fail("Internal error", "GetPublicKeyById: %v", err)
|
||||
}
|
||||
key.Updated = time.Now()
|
||||
if err = models.UpdatePublicKey(key); err != nil {
|
||||
log.GitLogger.Fatal(2, "UpdatePublicKey: %v", err)
|
||||
fail("Internal error", "UpdatePublicKey: %v", err)
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -149,7 +149,7 @@ repo_name_been_taken = Repository name has been already taken.
|
|||
org_name_been_taken = Organization name has been already taken.
|
||||
team_name_been_taken = Team name has been already taken.
|
||||
email_been_used = E-mail address has been already used.
|
||||
ssh_key_been_used = Public key name has been used.
|
||||
ssh_key_been_used = Public key name or content has been used.
|
||||
illegal_username = Your username contains illegal characters.
|
||||
illegal_repo_name = Repository name contains illegal characters.
|
||||
illegal_org_name = Organization name contains illegal characters.
|
||||
|
|
|
|||
|
|
@ -130,7 +130,6 @@ func extractTypeFromBase64Key(key string) (string, error) {
|
|||
|
||||
// Parse any key string in openssh or ssh2 format to clean openssh string (rfc4253)
|
||||
func ParseKeyString(content string) (string, error) {
|
||||
|
||||
// Transform all legal line endings to a single "\n"
|
||||
s := strings.Replace(strings.Replace(strings.TrimSpace(content), "\r\n", "\n", -1), "\r", "\n", -1)
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue