$name :: $heading

From e91490220686fb7f772e4f91e5a9f5a0ee663110 Mon Sep 17 00:00:00 2001 From: "Kyle J. McKay" Date: Fri, 5 Jul 2013 21:50:10 -0700 Subject: [PATCH] Stay inside the current URL scheme If the web server is configured to serve the Girocco/gitweb pages over both http and https, then previously the full URL configured as $Girocco::Config::webadmurl, $Girocco::Config::gitweburl, $Girocco::Config::gitwebfiles and $Girocco::Config::htmlurl would be embedded in any href=/src= links in pages being served up via the web server. This means that if the Girocco::Config values use 'http:' then web pages viewed using 'https:' would tend to escape to 'http:' and vice versa. Instead only embed the full URL path, but not the scheme or host part so that escape does not occur. --- Girocco/CGI.pm | 17 +++++++++-------- Girocco/Config.pm | 2 +- Girocco/User.pm | 5 +++-- cgi/delproj.cgi | 11 +++++++---- cgi/editproj.cgi | 28 +++++++++++++++++----------- cgi/edituser.cgi | 8 +++++--- cgi/html.cgi | 6 ++++-- cgi/mirrorproj.cgi | 10 ++++++---- cgi/regproj.cgi | 14 +++++++------- cgi/reguser.cgi | 2 +- gitweb/gitweb_config.perl | 25 +++++++++++++------------ html/httpspush.html | 8 ++++---- html/mob.html | 24 ++++++++++++++++++------ html/rootcert.html | 4 ++-- 14 files changed, 97 insertions(+), 67 deletions(-) diff --git a/Girocco/CGI.pm b/Girocco/CGI.pm index 174f001..d9c3459 100644 --- a/Girocco/CGI.pm +++ b/Girocco/CGI.pm @@ -4,6 +4,7 @@ use strict; use warnings; use Girocco::Config; +use Girocco::Util; BEGIN { our $VERSION = '0.1'; @@ -42,18 +43,18 @@ sub new { $name :: $heading - - - - - + + + + + $extraheadhtml

-$name / $section / $heading +

+$name / $section / $heading

EOT @@ -68,7 +69,7 @@ sub DESTROY { "hb=$Girocco::Config::giroccobranch;" : ""; print < -(view source) +(view source) EOT } diff --git a/Girocco/Config.pm b/Girocco/Config.pm index ee9917a..2471791 100644 --- a/Girocco/Config.pm +++ b/Girocco/Config.pm @@ -181,7 +181,7 @@ our $legalese = <By submitting this form, you are confirming that you will mirror or push only what we can store and show to anyone else who can visit this site without breaking any law, and that you will be nice to all small furry animals. -^{(more details)} +^{(more details)}

EOT diff --git a/Girocco/User.pm b/Girocco/User.pm index 4264c89..5322890 100644 --- a/Girocco/User.pm +++ b/Girocco/User.pm @@ -292,10 +292,11 @@ sub keys_html_list { next unless $type && $types{$type}; my $euser = CGI::escapeHTML(CGI::Util::escape($self->{name})); $html .= "

$bits $fingerprint ($types{$type}) $comment"; - $html .= "
". "download https push user authentication certificate ^{".
- "".
+ "".
"(learn more)}" if $type eq 'ssh-rsa' && $Girocco::Config::httpspushurl && $Girocco::Config::clientcert && diff --git a/cgi/delproj.cgi b/cgi/delproj.cgi index c006ba5..454cfc2 100755 --- a/cgi/delproj.cgi +++ b/cgi/delproj.cgi @@ -86,7 +86,8 @@ EOT $proj->{auth} or do { print <There currently isn't any project removal authorization code on file for -project $name. Please generate one.

+project $name. Please generate one.

EOT exit; }; @@ -94,8 +95,9 @@ EOT if ($auth ne $proj->{auth}) { print <Invalid authorization code, please re-enter or -generate a new one.

+generate a new one.

Authorization code:

@@ -150,7 +152,8 @@ $name ($url) from the site.

EOT if ($Girocco::Config::project_passwords) { print <Admin password: ^{(forgot password?)}

Admin password: ^{(forgot password?)}

EOT } print <param('y0')) { if ($proj->cgi_fill($gcgi) and $proj->authenticate($gcgi) and $proj->update) { print "

Project successfully updated.

\n"; if ($proj->{clone_failed}) { - print "

Please pass onwards.

\n"; - print "\n"; + print "

Please pass onwards.

\n"; + print "\n"; exit; } } } # $proj may be insane now but that's actually good for us since we'll let the -# user fix the invalid values she entered +# user fix the invalid values he or she entered my %h = $proj->form_defaults; print <{mirror}) { print <remove it.

+Just remove it.

EOT } else { if ($proj->is_empty) { print <remove it.

+Just remove it.

EOT } else { print <request an authorization code in order +request an authorization code in order to remove this project from the site.

EOT } @@ -100,13 +102,16 @@ my $statuschecked = $proj->{statusupdates} ? 'checked="checked"' : ''; print < - EOT if ($Girocco::Config::project_passwords) { print < + ^{(forgot password?)}

Project name:	$h{name}.git +
Project name:	$h{name}.git
Admin password:	- ^{(forgot password?)}
New admin password (twice): (leave empty to keep it the same)	@@ -126,15 +131,16 @@ if ($proj->{mirror}) {
Users:	EOT - $Girocco::Config::manage_users and print " Only registered users may push. "; + $Girocco::Config::manage_users and print " Only registered users may push. "; if ($Girocco::Config::mob and not grep { $_ eq $Girocco::Config::mob } @{$h{users}}) { print " (Please consider adding the `$Girocco::Config::mob` user.\n"; - print "^{(learn more)})\n"; + print "^{(learn more)})\n"; print " \n"; } foreach my $user (@{$h{users}}) { my $mlm = ''; - $mlm = " ^{(learn more)}" + $mlm = " ^{(learn more)}" if $Girocco::Config::mob && $user eq $Girocco::Config::mob; print " $user$mlm \n"; } diff --git a/cgi/edituser.cgi b/cgi/edituser.cgi index 2be52f5..443dd00 100755 --- a/cgi/edituser.cgi +++ b/cgi/edituser.cgi @@ -88,7 +88,8 @@ EOT exit; } else { $user->{auth} && $user->{authtype} ne 'DEL' or do { - print "There currently isn't any authorization code filed under your account. Please generate one."; + print "There currently isn't any authorization code filed under your account. ". + "Please generate one."; exit; }; @@ -98,7 +99,8 @@ EOT my $auth = $gcgi->wparam('auth'); if ($auth ne $user->{auth}) { - print ' Invalid authorization code, please re-enter or generate a new one. '; + print ' Invalid authorization code, please re-enter or ". + "generate a new one. '; _auth_form($name, "'Login'"); exit; } @@ -129,7 +131,7 @@ EOT my $httpspara = ''; $httpspara = <Please be sure to include at least one RSA key (starts with the `ssh-rsa` prefix) in -order to enable HTTPS pushing. ^{(learn more)} +order to enable HTTPS pushing. ^{(learn more)} X.509 (e.g. OpenSSL) format public keys can be converted to SSH .pub format with the ConvertPubKey utility thus obviating the need for OpenSSH if all pushing is to be done using HTTPS (see the example in the TIPS section of the `ConvertPubKey -h` output). diff --git a/cgi/html.cgi b/cgi/html.cgi index 2c108f1..5489951 100755 --- a/cgi/html.cgi +++ b/cgi/html.cgi @@ -8,18 +8,19 @@ use warnings; use lib "."; use Girocco::CGI; use Girocco::Config; - +use Girocco::Util; # Ultra-trivial templating engine; # /^@section=SECTION # /^@heading=HEADING # /^@header produces HTML header based on @section and @heading # /@@gitweburl@@/ substitute for gitweburl configuration variable +# /@@path(gitweburl)@@/ substitute for path portion of gitweburl variable # /@@ifmob@@...@@end@@/ remove unless mob defined # /@@ifssh@@...@@end@@/ remove unless pushurl defined # /@@ifhttps@@...@@end@@/ remove unless httpspushurl defined -my $pathinfo = $ENV{PATH_INFO}; +my $pathinfo = $ENV{PATH_INFO} \|\| ''; $pathinfo =~ s,^/,,; unless ($pathinfo) { my $gcgi = Girocco::CGI->new('HTML Templater'); @@ -59,6 +60,7 @@ foreach (split(/\n/, $template)) { $gcgi = Girocco::CGI->new($heading, $section); next; } else { + s/@\@path$(\w+?)$@@/url_path(${$Girocco::Config::{$1}})/ge; s/@@(\w+?)@@/${$Girocco::Config::{$1}}/ge; print "$_\n"; } diff --git a/cgi/mirrorproj.cgi b/cgi/mirrorproj.cgi index 9f3d561..2a164ca 100755 --- a/cgi/mirrorproj.cgi +++ b/cgi/mirrorproj.cgi @@ -46,15 +46,15 @@ $\| = 1; if (!$proj->{clone_logged} or $proj->{clone_failed}) { # Kick off the clone since it is not running yet print " Initiated mirroring of ".$proj->{url}." to $Girocco::Config::name project ". - "$name.git: \n"; + "$name.git: \n"; $proj->clone; } elsif ($proj->{clone_in_progress}) { print " Mirroring of ".$proj->{url}." to $Girocco::Config::name project ". - "$name.git in progress: \n"; + "$name.git in progress: \n"; } else { print " Mirroring of ".$proj->{url}." to $Girocco::Config::name project ". - "$name.git completed: \n"; + "$name.git completed: \n"; } print " \n"; @@ -79,6 +79,8 @@ $proj or die "not found project $name on second load, that's _REALLY_ weird!"; if ($proj->{clone_failed}) { print <Mirroring failed! Please revisit the project settings. + Mirroring failed! Please revisit the project settings. EOT } diff --git a/cgi/regproj.cgi b/cgi/regproj.cgi index d8e7f6f..a39b40e 100755 --- a/cgi/regproj.cgi +++ b/cgi/regproj.cgi @@ -74,8 +74,8 @@ if ($cgi->param('mode')) { } $proj->premirror; $proj->clone; - print " Please pass onwards. \n"; - print "\n"; + print " Please pass onwards. \n"; + print "\n"; } else { unless ($Girocco::Config::push) { @@ -85,12 +85,12 @@ if ($cgi->param('mode')) { $proj->conjure; print < -Project $name successfully set up. +Project $name successfully set up. EOT my @pushurls = (); push(@pushurls, "`$Girocco::Config::pushurl/$name.git`") if $Girocco::Config::pushurl; push(@pushurls, "`$Girocco::Config::httpspushurl/$name.git` " . - "^{(learn more)}") + "^{(learn more)}") if $Girocco::Config::httpspushurl; print " The push URL(s) for the project: " . join(", ", @pushurls) . " " if @pushurls; my @pullurls = (); @@ -102,17 +102,17 @@ EOT my $regnotice = ''; if ($Girocco::Config::manage_users) { $regnotice = <register himself as a user first. +Everyone who wants to push must register oneself as a user first. (One user can have push access to multiple projects and multiple users can have push access to one project.) EOT } my $pushy = $Girocco::Config::pushurl \|\| $Girocco::Config::httpspushurl; my $pushyhint = ''; $pushyhint = " # ^{" . - "(learn more)}" . + "(learn more)" . "" if $pushy =~ /^https:/i; print <You can assign users now + You can assign users now - don't forget to assign yourself as a user as well if you want to push! $regnotice diff --git a/cgi/reguser.cgi b/cgi/reguser.cgi index 17fed9b..3aed6c0 100755 --- a/cgi/reguser.cgi +++ b/cgi/reguser.cgi @@ -57,7 +57,7 @@ EOT my $httpspara = ''; $httpspara = <Please be sure to include at least one RSA key (starts with the `ssh-rsa` prefix) in -order to enable HTTPS pushing. ^{(learn more)} +order to enable HTTPS pushing. ^{(learn more)} X.509 (e.g. OpenSSL) format public keys can be converted to SSH .pub format with the ConvertPubKey utility. EOT diff --git a/gitweb/gitweb_config.perl b/gitweb/gitweb_config.perl index 55c4ee3..acb0e7b 100644 --- a/gitweb/gitweb_config.perl +++ b/gitweb/gitweb_config.perl @@ -1,6 +1,7 @@ # Pull Girocco config use lib "."; use Girocco::Config; +use Girocco::Util; ## For the complete overview of available configuration options, ## see git.git/gitweb/gitweb.perl file beginning (git.git/gitweb/README @@ -21,7 +22,7 @@ our $projlist_cache_lifetime = 10; our $default_text_plain_charset = 'utf-8'; # Comment out to disable ctags -$feature{ctags}{default}=["$Girocco::Config::webadmurl/tagproj.cgi"]; +$feature{ctags}{default}=["@{[url_path($Girocco::Config::webadmurl)]}/tagproj.cgi"]; $feature{blame}{default}=[1]; @@ -31,13 +32,13 @@ $feature{'snapshot'}{'default'} = ['tgz', 'zip']; ### You probably don't really want to tweak anything below. # Base web path -our $my_uri = $Girocco::Config::gitweburl; +our $my_uri = url_path($Girocco::Config::gitweburl); # https hint html inserted right after any https push URL (undef for none) # e.g. "https push instructions" our $https_hint_html = undef; $https_hint_html = substr(<(learn more) +^{(learn more)} HINT ## core git executable to use @@ -50,7 +51,7 @@ our $projectroot = $Girocco::Config::reporoot; our $projects_list = $Girocco::Config::chroot."/etc/gitweb.list"; # ## target of the home link on top of all pages -our $home_link = $Girocco::Config::gitweburl; +our $home_link = url_path($Girocco::Config::gitweburl); # ## string of the home link on top of all pages our $home_link_str = $Girocco::Config::name; @@ -62,15 +63,15 @@ our $site_name = $Girocco::Config::title; our $home_text = "$Girocco::Config::webroot/indextext.html"; # ## URI of stylesheets -our @stylesheets = ("$Girocco::Config::gitwebfiles/gitweb.css"); +our @stylesheets = ("@{[url_path($Girocco::Config::gitwebfiles)]}/gitweb.css"); ## URI of GIT logo (72x27 size) -our $logo = "$Girocco::Config::gitwebfiles/git-logo.png"; +our $logo = "@{[url_path($Girocco::Config::gitwebfiles)]}/git-logo.png"; ## URI of GIT favicon, assumed to be image/png type -our $favicon = "$Girocco::Config::gitwebfiles/git-favicon.png"; +our $favicon = "@{[url_path($Girocco::Config::gitwebfiles)]}/git-favicon.png"; ## URI of blame.js -our $blamejs = "$Girocco::Config::gitwebfiles/blame.js"; +our $blamejs = "@{[url_path($Girocco::Config::gitwebfiles)]}/blame.js"; ## URI of gitweb.js -our $gitwebjs = "$Girocco::Config::gitwebfiles/gitweb.js"; +our $gitwebjs = "@{[url_path($Girocco::Config::gitwebfiles)]}/gitweb.js"; # ## list of git base URLs used for URL to fetch project from, ## i.e. full URL is "$git_base_url/$project" @@ -92,7 +93,7 @@ $feature{pathinfo}{default}=[1]; $feature{forks}{default}=[1]; $feature{actions}{default}=[ - ('graphiclog', "$Girocco::Config::gitwebfiles/git-browser/by-commit.html?r=%n", 'log'), - ('edit', "$Girocco::Config::webadmurl/editproj.cgi?name=%n", 'refs'), - ('fork', "$Girocco::Config::webadmurl/regproj.cgi?fork=%n", 'edit') + ('graphiclog', "@{[url_path($Girocco::Config::gitwebfiles)]}/git-browser/by-commit.html?r=%n", 'log'), + ('edit', "@{[url_path($Girocco::Config::webadmurl)]}/editproj.cgi?name=%n", 'refs'), + ('fork', "@{[url_path($Girocco::Config::webadmurl)]}/regproj.cgi?fork=%n", 'edit') ]; diff --git a/html/httpspush.html b/html/httpspush.html index 8e86c67..dd967ce 100644 --- a/html/httpspush.html +++ b/html/httpspush.html @@ -14,10 +14,10 @@ or the Update user email/SSH Keys page. Prerequisites Assuming the user login name is `test` and the -root certificate +root certificate has been downloaded to `/tmp/@@nickname@@_root_cert.pem` (see -here for more information about the -root certificate), +here for more information about the +root certificate), the single RSA SSH public key from `~/.ssh/id_rsa.pub` has been uploaded as the sole public key for the `test` user and the resulting `test` user authentication certifcate has been downloaded to @@ -79,7 +79,7 @@ git push --all origin error since the test user does not have permission to push to the `mobexample.git` project@@ifmob@@, but the mob user can push to the mob branch of `mobexample.git` over https as detailed -here@@end@@. +here@@end@@. Password Caching diff --git a/html/mob.html b/html/mob.html index e50108a..a17477c 100644 --- a/html/mob.html +++ b/html/mob.html @@ -69,7 +69,8 @@ git commit -m 'example commit' git push origin mob - Note that it’s not strictly necessary to fetch with the git protocol, the ssh protocol can also be used for fetching. + Note that it’s not strictly necessary to fetch with the git protocol, +the ssh protocol can also be used for fetching. @@end@@ @@ifhttps@@ @@ -79,25 +80,32 @@ git push origin mob The @@nickname@@ root certificate - This can be fetched from here and will be assumed to be saved to `/tmp/@@nickname@@_root_cert.pem` in the push example. See also the Root Certificate Information. + This can be fetched from here +and will be assumed to be saved to `/tmp/@@nickname@@_root_cert.pem` in the push example. +See also the Root Certificate Information. cd /tmp && curl -O @@gitwebfiles@@/@@nickname@@_root_cert.pem The mob user certificate - This can be fetched from here and will be assumed to be saved to `/tmp/@@nickname@@_mob_user.pem` in the push example. + This can be fetched from here +and will be assumed to be saved to `/tmp/@@nickname@@_mob_user.pem` in the push example. cd /tmp && curl -O @@gitwebfiles@@/@@nickname@@_mob_user.pem The mob user private key - This can be fetched from here and will be assumed to be saved to `/tmp/@@nickname@@_mob_key.pem` in the push example. Normally, of course, private keys are never shared, but as described above, since everyone is allowed to push to the mob branch the private key for the mob user must be shared with everyone. + This can be fetched from here +and will be assumed to be saved to `/tmp/@@nickname@@_mob_key.pem` in the push example. +Normally, of course, private keys are never shared, but as described above, since everyone +is allowed to push to the mob branch the private key for the mob user must be shared with everyone. cd /tmp && curl -O @@gitwebfiles@@/@@nickname@@_mob_key.pem - With the prerequisites out of the way, here’s the mob ssh example redone to use the smart http protocol: + With the prerequisites out of the way, here’s the mob ssh example +redone to use the smart http protocol: cd /tmp @@ -113,5 +121,9 @@ git commit -m 'example commit' git push origin mob - Note that it’s not strictly necessary to fetch with the http protocol, the https protocol can also be used for fetching but when initially cloning the repository it can be a bother to get the two certificates and the key set properly without a project-specific place to configure them yet. See the output of `git config help` for more information about configuring certificates and keys. + Note that it’s not strictly necessary to fetch with the http protocol, +the https protocol can also be used for fetching but when initially cloning the repository +it can be a bother to get the two certificates and the key set properly without a +project-specific place to configure them yet. See the output of `git config help` for +more information about configuring certificates and keys. @@end@@ diff --git a/html/rootcert.html b/html/rootcert.html index 0403e26..a66c82c 100644 --- a/html/rootcert.html +++ b/html/rootcert.html @@ -15,7 +15,7 @@ browser, this site uses its own root certificate. The root certificate for this site is available from: -@@gitwebfiles@@/@@nickname@@_root_cert.pem +@@webadmurl@@/@@nickname@@_root_cert.pem A side effect of using an unrecognized root certificate is that Git may @@ -73,5 +73,5 @@ or initialized. For further details see the `git help config` output. @@ifmob@@ - For information on how to push to the mob branch using https see here. + For information on how to push to the mob branch using https see here. @@end@@ -- 2.11.4.GIT

Prerequisites

Password Caching