hooks/update

   1 #!/bin/sh
   2 #
   3 # Currently, we just confine the mob user to the mob branch here.
   4 #
   5 # TODO: Generalized branches push permissions support.
   6
   7 set -e
   8
   9 if ! [ -x @perlbin@ ]; then
  10         # We are INSIDE the chroot
  11
  12         reporoot=/@jailreporoot@
  13         reporoot="$(cd "$reporoot" && pwd -P)"
  14         webadmurl=@webadmurl@
  15         mob=@mob@
  16         proj="$(pwd -P)"; proj="${proj#$reporoot/}"
  17         mobdir=
  18         case "$proj" in *?/mob)
  19                 mobdir=1
  20                 proj="${proj%/mob}"
  21         esac
  22         projbare="${proj%.git}"
  23
  24         if ! [ -f "$reporoot/$proj/.nofetch" ]; then
  25                 echo "The $proj project is a mirror and may not be pushed to, sorry" >&2
  26                 exit 3
  27         fi
  28
  29         if [ -n "$mobdir" -a "$mob" != "mob" ]; then
  30                 # Should only get here if there's a misconfiguration
  31                 echo "Personal mob branches are not supported" >&2
  32                 exit 3
  33         fi
  34         if [ -n "$mobdir" -a "$LOGNAME" = "mob" ]; then
  35                 # Should only get here if there's a misconfiguration
  36                 echo "The mob user may not use personal mob branches" >&2
  37                 exit 3
  38         fi
  39         if [ -n "$mobdir" -a ! -d "$reporoot/$proj/mob" ]; then
  40                 # Should only get here if there's a misconfiguration
  41                 echo "The project '$proj' does not support personal mob branches" >&2
  42                 exit 3
  43         fi
  44         if [ -n "$mobdir" ] && ! can_user_push "$projbare" mob; then
  45                 # Should only get here if there's a misconfiguration
  46                 echo "The user 'mob' does not have push permissions for project '$proj'" >&2
  47                 echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
  48                 exit 3
  49         fi
  50         if [ -n "$mobdir" ]; then
  51                 # All personal mob refs must start with refs/heads/mob.$USER,
  52                 # refs/heads/mob_$USER/, refs/mob/mob.$USER or refs/mob/mob_$USER/
  53                 case "$1" in
  54                 "refs/heads/mob.$LOGNAME"       | \
  55                 "refs/heads/mob_$LOGNAME/"?*    | \
  56                 "refs/mob/mob.$LOGNAME"         | \
  57                 "refs/mob/mob_$LOGNAME/"?*      ) :;;
  58                 *)
  59                         echo "The user '$LOGNAME' does not have push permissions for project '$proj'." >&2
  60                         echo "However '$proj' allows pushes to personal mob branches w/o push perms." >&2
  61                         echo "The ref '$1' is not a valid personal mob branch ref name." >&2
  62                         echo "Valid personal mob branch ref names are one of the following:" >&2
  63                         echo "  refs/heads/mob.$LOGNAME or refs/mob/mob.$LOGNAME" >&2
  64                         echo "or refs that start with one of the following:" >&2
  65                         echo "  refs/heads/mob_$LOGNAME/ or refs/mob/mob_$LOGNAME/" >&2
  66                         echo "No other personal mob branch ref names may be pushed to, sorry." >&2
  67                         echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
  68                         exit 3
  69                 esac
  70                 exit 0
  71         fi
  72
  73         if ! can_user_push "$projbare"; then
  74                 echo "The user '$LOGNAME' does not have push permissions for project '$proj'" >&2
  75                 echo "You may adjust push permissions at $webadmurl/editproj.cgi?name=$proj" >&2
  76                 exit 3
  77         fi
  78
  79         if [ "$mob" = "mob" -a "$LOGNAME" = "mob" ]; then
  80                 if [ x"$1" != x"refs/heads/mob" ]; then
  81                         echo "The mob user may push only to the 'mob' branch, sorry" >&2
  82                         exit 1
  83                 fi
  84                 if [ x"$2" = x"0000000000000000000000000000000000000000" ]; then
  85                         echo "The mob user may not _create_ the 'mob' branch, sorry" >&2
  86                         exit 2
  87                 fi
  88                 if [ x"$3" = x"0000000000000000000000000000000000000000" ]; then
  89                         echo "The mob user may not _delete_ the 'mob' branch, smch, sorry"
  90                         exit 3
  91                 fi
  92         fi
  93
  94         if [ "$mob" = "mob" ]; then
  95                 case "$1" in
  96                 "refs/heads/mob."?* | "refs/heads/mob_"?*)
  97                         echo "Use of the ref '$1' is reserved for personal mob branch" >&2
  98                         echo "users who do not have push permission to project '$proj'." >&2
  99                         echo "Users with push permission may only access the personal" >&2
 100                         echo "mob branches using refs that start with 'refs/mob/'." >&2
 101                         exit 3
 102                 esac
 103         fi
 104
 105         exit 0
 106 fi
 107
 108 # We are NOT inside the chroot
 109
 110 . @basedir@/shlib.sh
 111 reporoot="$(cd "$cfg_reporoot" && pwd -P)"
 112
 113 if [ "$cfg_permission_control" = "Hooks" ]; then
 114         # We have some permission control to do!
 115         proj="$(pwd -P)"; proj="${proj#$reporoot/}"; projbare="${proj%.git}"
 116         # XXX: Sanity check on project name and $USER here? Seems superfluous.
 117         if ! "$cfg_basedir/bin/can_user_push_http" "$projbare" "$USER"; then
 118                 echo "The user '$USER' does not have push permissions for project '$proj'" >&2
 119                 echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 120                 exit 3
 121         fi
 122 fi
 123
 124 if [ -n "$GIT_PROJECT_ROOT" ]; then
 125         # We are doing a smart HTTP push
 126
 127         proj="$(pwd -P)"; proj="${proj#$reporoot/}"
 128         mobdir=
 129         case "$proj" in *?/mob)
 130                 mobdir=1
 131                 proj="${proj%/mob}"
 132         esac
 133         projbare="${proj%.git}"
 134
 135         if ! [ -f "$reporoot/$proj/.nofetch" ]; then
 136                 echo "The $proj project is a mirror and may not be pushed to, sorry" >&2
 137                 exit 3
 138         fi
 139
 140         authuser="${REMOTE_USER#/UID=}"
 141         authuuid="${authuser}"
 142         authuser="${authuser%/dnQualifier=*}"
 143         authuuid="${authuuid#$authuser}"
 144         authuuid="${authuuid#/dnQualifier=}"
 145         if [ -z "$authuser" ]; then
 146                 echo "Only authenticated users may push, sorry" >&2
 147                 exit 3
 148         fi
 149         if [ "$authuser" != "mob" -o "$cfg_mob" != "mob" ]; then
 150                 if ! useruuid="$("$cfg_basedir/bin/get_user_uuid" "$authuser")" || [ "$useruuid" != "$authuuid" ]; then
 151                         echo "The user '$authuser' certificate being used is no longer valid."
 152                         echo "You may download a new user certificate at $cfg_webadmurl/edituser.cgi"
 153                         exit 3
 154                 fi
 155         fi
 156
 157         if [ -n "$mobdir" -a "$cfg_mob" != "mob" ]; then
 158                 # Should only get here if there's a misconfiguration
 159                 echo "Personal mob branches are not supported" >&2
 160                 exit 3
 161         fi
 162         if [ -n "$mobdir" -a "$authuser" = "mob" ]; then
 163                 # Should only get here if there's a misconfiguration
 164                 echo "The mob user may not use personal mob branches" >&2
 165                 exit 3
 166         fi
 167         if [ -n "$mobdir" -a ! -d "$reporoot/$proj/mob" ]; then
 168                 # Should only get here if there's a misconfiguration
 169                 echo "The project '$proj' does not support personal mob branches" >&2
 170                 exit 3
 171         fi
 172         if [ -n "$mobdir" ] && ! "$cfg_basedir/bin/can_user_push_http" "$projbare" "mob"; then
 173                 # Should only get here if there's a misconfiguration
 174                 echo "The user 'mob' does not have push permissions for project '$proj'" >&2
 175                 echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 176                 exit 3
 177         fi
 178         if [ -n "$mobdir" ]; then
 179                 # All personal mob refs must start with refs/heads/mob.$USER,
 180                 # refs/heads/mob_$USER/, refs/mob/mob.$USER or refs/mob/mob_$USER/
 181                 case "$1" in
 182                 "refs/heads/mob.$authuser"      | \
 183                 "refs/heads/mob_$authuser/"?*   | \
 184                 "refs/mob/mob.$authuser"        | \
 185                 "refs/mob/mob_$authuser/"?*     ) :;;
 186                 *)
 187                         echo "The user '$authuser' does not have push permissions for project '$proj'." >&2
 188                         echo "However '$proj' allows pushes to personal mob branches w/o push perms." >&2
 189                         echo "The ref '$1' is not a valid personal mob branch ref name." >&2
 190                         echo "Valid personal mob branch ref names are one of the following:" >&2
 191                         echo "  refs/heads/mob.$authuser or refs/mob/mob.$authuser" >&2
 192                         echo "or refs that start with one of the following:" >&2
 193                         echo "  refs/heads/mob_$authuser/ or refs/mob/mob_$authuser/" >&2
 194                         echo "No other personal mob branch ref names may be pushed to, sorry." >&2
 195                         echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 196                         exit 3
 197                 esac
 198                 exit 0
 199         fi
 200
 201         if ! "$cfg_basedir/bin/can_user_push_http" "$projbare" "$authuser"; then
 202                 echo "The user '$authuser' does not have push permissions for project '$proj'" >&2
 203                 echo "You may adjust push permissions at $cfg_webadmurl/editproj.cgi?name=$proj" >&2
 204                 exit 3
 205         fi
 206
 207         if [ "$cfg_mob" = "mob" -a "$authuser" = "mob" ]; then
 208                 if [ x"$1" != x"refs/heads/mob" ]; then
 209                         echo "The mob user may push only to the 'mob' branch, sorry" >&2
 210                         exit 1
 211                 fi
 212                 if [ x"$2" = x"0000000000000000000000000000000000000000" ]; then
 213                         echo "The mob user may not _create_ the 'mob' branch, sorry" >&2
 214                         exit 2
 215                 fi
 216                 if [ x"$3" = x"0000000000000000000000000000000000000000" ]; then
 217                         echo "The mob user may not _delete_ the 'mob' branch, smch, sorry"
 218                         exit 3
 219                 fi
 220         fi
 221
 222         if [ "$cfg_mob" = "mob" ]; then
 223                 case "$1" in
 224                 "refs/heads/mob."?* | "refs/heads/mob_"?*)
 225                         echo "Use of the ref '$1' is reserved for personal mob branch" >&2
 226                         echo "users who do not have push permission to project '$proj'." >&2
 227                         echo "Users with push permission may only access the personal" >&2
 228                         echo "mob branches using refs that start with 'refs/mob/'." >&2
 229                         exit 3
 230                 esac
 231         fi
 232 fi
 233
 234 exit 0