3 # Abort any push early if the pushing user doesn't have any push permissions
4 # at all. This avoids unnecessary traffic and unpacked object pollution.
6 # Set GIT_HTTP_BACKEND_BIN to change the default http-backend binary from
7 # the default of Config.pm $git_http_backend_bin (which itself has a default
8 # of "/usr/lib/git-core/git-http-backend")
10 # Note that GIT_PROJECT_ROOT must be set to use this script.
12 # Also prevent standard error output from git-http-backend cluttering up the
13 # server's log unless GIT_HTTP_BACKEND_SHOW_ERRORS is set to a non-empty value.
19 [ -z "$GIT_HTTP_BACKEND_BIN" ] || cfg_git_http_backend_bin
="$GIT_HTTP_BACKEND_BIN"
20 [ -n "$cfg_git_http_backend_bin" ] ||
21 cfg_git_http_backend_bin
=/usr
/lib
/git-core
/git-http-backend
23 # This script is called for both fetch and push.
24 # Only the following conditions trigger a push permissions check:
26 # 1. REQUEST_METHOD=GET
27 # and PATH_INFO ends with "/info/refs"
28 # and QUERY_STRING has "service=git-receive-pack"
30 # 2. REQUEST_METHOD=POST
31 # and PATH_INFO ends with "/git-receive-pack"
33 # Note that there is no check for PATH_INFO being under a certain root as
34 # it's presumed that GIT_PROJECT_ROOT has been set and so all PATH_INFO
35 # values are effectively forced under the desired root.
36 # The project name is, however, extracted and the project directory must exist
37 # under $cfg_reporoot.
41 # A single CR (0x0d) is between the quotes
43 echo "Status: $1 $2$cr"
44 echo "Expires: Fri, 01 Jan 1980 00:00:00 GMT$cr"
45 echo "Pragma: no-cache$cr"
46 echo "Cache-Control: no-cache, max-age=0, must-revalidate$cr"
47 echo "Content-Type: text/plain$cr"
53 while [ $# -gt 0 ]; do
61 errorhdrs
500 "Internal Server Error"
63 msglines
"Internal Server Error"
64 echo "Internal Server Error" >&2
67 while [ $# -gt 0 ]; do
77 errorhdrs
403 Forbidden
88 errorhdrs
401 "Authorization Required"
90 msglines
"Authorization Required"
97 [ -n "$GIT_PROJECT_ROOT" ] ||
{ internalerr
'GIT_PROJECT_ROOT must be set'; exit 1; }
101 pathcheck
="${PATH_INFO#/}"
102 if [ "$REQUEST_METHOD" = "GET" -o "$REQUEST_METHOD" = "HEAD" ]; then
103 case "$pathcheck" in *"/info/refs")
104 case "&$QUERY_STRING&" in *"&service=git-receive-pack&"*)
106 proj
="${pathcheck%/info/refs}"
109 elif [ "$REQUEST_METHOD" = "POST" ]; then
110 case "$pathcheck" in *"/git-receive-pack")
112 proj
="${pathcheck%/git-receive-pack}"
116 if [ -z "$needscheck" ]; then
117 if [ -n "$GIT_HTTP_BACKEND_SHOW_ERRORS" ]; then
118 exec "$cfg_git_http_backend_bin" "$@"
120 exec "$cfg_git_http_backend_bin" "$@" 2>/dev
/null
122 internalerr
"exec failed: $cfg_git_http_backend_bin"
126 # add a missing trailing .git
133 dir
="$cfg_reporoot/$proj"
134 if ! [ -d "$dir" ] ||
! [ -f "$dir/HEAD" ] ||
! [ -d "$dir/objects" ]; then
139 projbare
="${proj%.git}"
141 if ! [ -f "$dir/.nofetch" ]; then
142 forbidden
"The $proj project is a mirror and may not be pushed to, sorry"
146 authuser
="${REMOTE_USER#/UID=}"
147 authuuid
="${authuser}"
148 authuser
="${authuser%/dnQualifier=*}"
149 authuuid
="${authuuid#$authuser}"
150 authuuid
="${authuuid#/dnQualifier=}"
151 if [ -z "$authuser" ]; then
152 needsauth
"Only authenticated users may push, sorry"
156 if perl
-I@basedir@
-MGirocco::Project
-MGirocco::User
<<EOT; then :; else
157 my \$p = Girocco::Project->load('$projbare');
158 exit 1 unless \$p && \$p->can_user_push('$authuser');
159 exit 0 if \$Girocco::Config::mob eq 'mob' && '$authuser' eq 'mob';
160 my \$u = Girocco::User->load('$authuser');
161 exit 2 unless \$u && \$u->{uuid} eq '$authuuid';
164 if [ $?
-eq 2 ]; then
165 forbidden
"The user '$authuser' certificate being used is no longer valid." \
166 "You may download a new user certificate at $cfg_webadmurl/edituser.cgi"
168 forbidden
"The user '$authuser' does not have push permissions for project '$proj'." \
169 "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj"
174 if [ -n "$GIT_HTTP_BACKEND_SHOW_ERRORS" ]; then
175 exec "$cfg_git_http_backend_bin" "$@"
177 exec "$cfg_git_http_backend_bin" "$@" 2>/dev
/null
179 internalerr
"exec failed: $cfg_git_http_backend_bin"