| commit | 5faff90e7647c3b6580d6e95821d9cf0499f2e9b | |
| author | Kyle J. McKay <mackyle@gmail.com> | |
| Sun, 8 Feb 2015 01:16:23 +0000 (7 17:16 -0800) | ||
| committer | Kyle J. McKay <mackyle@gmail.com> | |
| Sun, 8 Feb 2015 01:16:23 +0000 (7 17:16 -0800) | ||
| tree | bb0b083b25e40574c417862677dba2e7e23b3d05 | treesnapshot (tar.gz zip) |
| parent | f007f9211f9fab684ad6ded0ddf2f9176156c4d9 | commitdiff |
apache.conf.in: do not allow accelerated access to '_' projects
While the rest of Girocco denies external access to any project
names starting with '_' (which are reserved for internal use),
the accelerated access to packs and loose objects provided by the
web server configuration for non-smart HTTP access provided a
loophole by which some parts of projects starting with '_' could
be accessed.
Close the loophole by only accelerating access for project names
which do NOT start with '_'. Requests for non-smart HTTP access
to loose objects and/or packs for project names starting with '_'
will then be sent to git-http-backend-verify instead which will
send the correct denied result code rather than allowing access.
While the rest of Girocco denies external access to any project
names starting with '_' (which are reserved for internal use),
the accelerated access to packs and loose objects provided by the
web server configuration for non-smart HTTP access provided a
loophole by which some parts of projects starting with '_' could
be accessed.
Close the loophole by only accelerating access for project names
which do NOT start with '_'. Requests for non-smart HTTP access
to loose objects and/or packs for project names starting with '_'
will then be sent to git-http-backend-verify instead which will
send the correct denied result code rather than allowing access.
| apache.conf.in | diffblobblamehistory |