Do not grant fork CLONE permissions to users/teams with implied regex CLONE...

James Moger

2014-02-26 ba2f9aa95ee55f3672cd59474c65b959d0fe7fb5

 src/main/java/com/gitblit/git/GitblitReceivePack.java

@@ -44,9 +44,10 @@


import com.gitblit.Constants;

import com.gitblit.Constants.AccessRestrictionType;

import com.gitblit.GitBlit;

import com.gitblit.IStoredSettings;

import com.gitblit.Keys;

import com.gitblit.client.Translation;

import com.gitblit.manager.IGitblit;

import com.gitblit.models.RepositoryModel;

import com.gitblit.models.UserModel;

import com.gitblit.utils.ArrayUtils;

@@ -84,18 +85,27 @@


   protected String gitblitUrl;



   protected String repositoryUrl;



   protected GroovyScriptEngine gse;



   public GitblitReceivePack(Repository db, RepositoryModel repository, UserModel user) {

   protected final IStoredSettings settings;



   protected final IGitblit gitblit;



   public GitblitReceivePack(

         IGitblit gitblit,

         Repository db,

         RepositoryModel repository,

         UserModel user) {



      super(db);

      this.settings = gitblit.getSettings();

      this.gitblit = gitblit;

      this.repository = repository;

      this.user = user == null ? UserModel.ANONYMOUS : user;

      this.groovyDir = GitBlit.getGroovyScriptsFolder();

      this.user = user;

      this.groovyDir = gitblit.getHooksFolder();

      try {

         // set Grape root

         File grapeRoot = GitBlit.getFileOrFolder(Keys.groovy.grapeFolder, "${baseFolder}/groovy/grape").getAbsoluteFile();

         File grapeRoot = gitblit.getGrapesFolder();

         grapeRoot.mkdirs();

         System.setProperty("grape.root", grapeRoot.getAbsolutePath());

         this.gse = new GroovyScriptEngine(groovyDir.getAbsolutePath());

@@ -106,7 +116,7 @@
      setAllowCreates(user.canCreateRef(repository));

      setAllowDeletes(user.canDeleteRef(repository));

      setAllowNonFastForwards(user.canRewindRef(repository));

		


      // setup pre and post receive hook

      setPreReceiveHook(this);

      setPostReceiveHook(this);

@@ -119,6 +129,14 @@
    */

   @Override

   public void onPreReceive(ReceivePack rp, Collection<ReceiveCommand> commands) {



      if (repository.isMirror) {

         // repository is a mirror

         for (ReceiveCommand cmd : commands) {

            sendRejection(cmd, "Gitblit does not allow pushes to \"{0}\" because it is a mirror!", repository.name);

         }

         return;

      }



      if (repository.isFrozen) {

         // repository is frozen/readonly

@@ -147,8 +165,11 @@
      if (repository.accessRestriction.atLeast(AccessRestrictionType.PUSH) && repository.verifyCommitter) {

         // enforce committer verification

         if (StringUtils.isEmpty(user.emailAddress)) {

            // emit warning if user does not have an email address

            LOGGER.warn(MessageFormat.format("Consider setting an email address for {0} ({1}) to improve committer verification.", user.getDisplayName(), user.username));

            // reject the push because the pushing account does not have an email address

            for (ReceiveCommand cmd : commands) {

               sendRejection(cmd, "Sorry, the account \"{0}\" does not have an email address set for committer verification!", user.username);

            }

            return;

         }



         // Optionally enforce that the committer of first parent chain

@@ -181,16 +202,9 @@


                  PersonIdent committer = commit.getCommitterIdent();

                  if (!user.is(committer.getName(), committer.getEmailAddress())) {

                     String reason;

                     if (StringUtils.isEmpty(user.emailAddress)) {

                        // account does not have an email address

                        reason = MessageFormat.format("{0} by {1} <{2}> was not committed by {3} ({4})",

                              commit.getId().name(), committer.getName(), StringUtils.isEmpty(committer.getEmailAddress()) ? "?":committer.getEmailAddress(), user.getDisplayName(), user.username);

                     } else {

                        // account has an email address

                        reason = MessageFormat.format("{0} by {1} <{2}> was not committed by {3} ({4}) <{5}>",

                              commit.getId().name(), committer.getName(), StringUtils.isEmpty(committer.getEmailAddress()) ? "?":committer.getEmailAddress(), user.getDisplayName(), user.username, user.emailAddress);

                     }

                     // verification failed

                     String reason = MessageFormat.format("{0} by {1} <{2}> was not committed by {3} ({4}) <{5}>",

                           commit.getId().name(), committer.getName(), StringUtils.isEmpty(committer.getEmailAddress()) ? "?":committer.getEmailAddress(), user.getDisplayName(), user.username, user.emailAddress);

                     LOGGER.warn(reason);

                     cmd.setResult(Result.REJECTED_OTHER_REASON, reason);

                     allRejected &= true;

@@ -210,13 +224,13 @@
         }

      }



      // reset branch commit cache on REWIND and DELETE

      for (ReceiveCommand cmd : commands) {

         String ref = cmd.getRefName();

         if (ref.startsWith(Constants.R_HEADS)) {

            switch (cmd.getType()) {

            case UPDATE_NONFASTFORWARD:

            case DELETE:

               // reset branch commit cache on REWIND and DELETE

               CommitCache.instance().clear(repository.name, ref);

               break;

            default:

@@ -226,7 +240,7 @@
      }



      Set<String> scripts = new LinkedHashSet<String>();

      scripts.addAll(GitBlit.self().getPreReceiveScriptsInherited(repository));

      scripts.addAll(gitblit.getPreReceiveScriptsInherited(repository));

      if (!ArrayUtils.isEmpty(repository.preReceiveScripts)) {

         scripts.addAll(repository.preReceiveScripts);

      }

@@ -295,7 +309,7 @@
               String msg = MessageFormat.format(template, branch);

               String prefix;

               if (StringUtils.isEmpty(repository.incrementalPushTagPrefix)) {

                  prefix = GitBlit.getString(Keys.git.defaultIncrementalPushTagPrefix, "r");

                  prefix = settings.getString(Keys.git.defaultIncrementalPushTagPrefix, "r");

               } else {

                  prefix = repository.incrementalPushTagPrefix;

               }

@@ -321,7 +335,7 @@


      // run Groovy hook scripts

      Set<String> scripts = new LinkedHashSet<String>();

      scripts.addAll(GitBlit.self().getPostReceiveScriptsInherited(repository));

      scripts.addAll(gitblit.getPostReceiveScriptsInherited(repository));

      if (!ArrayUtils.isEmpty(repository.postReceiveScripts)) {

         scripts.addAll(repository.postReceiveScripts);

      }

@@ -374,10 +388,6 @@
      this.gitblitUrl = url;

   }



   protected void setRepositoryUrl(String url) {

      this.repositoryUrl = url;

   }



   protected void sendRejection(final ReceiveCommand cmd, final String why, Object... objects) {

      String text;

      if (ArrayUtils.isEmpty(objects)) {

@@ -389,14 +399,22 @@
      LOGGER.error(text + " (" + user.username + ")");

   }



   protected void sendMessage(String msg, Object... objects) {

   protected void sendHeader(String msg, Object... objects) {

      sendInfo("--> ", msg, objects);

   }



   protected void sendInfo(String msg, Object... objects) {

      sendInfo("    ", msg, objects);

   }



   protected void sendInfo(String prefix, String msg, Object... objects) {

      String text;

      if (ArrayUtils.isEmpty(objects)) {

         text = msg;

         super.sendMessage(msg);

         super.sendMessage(prefix + msg);

      } else {

         text = MessageFormat.format(msg, objects);

         super.sendMessage(text);

         super.sendMessage(prefix + text);

      }

      LOGGER.info(text + " (" + user.username + ")");

   }

@@ -421,14 +439,14 @@
    * @param commands

    * @param scripts

    */

   protected void runGroovy(Collection<ReceiveCommand> commands, Set<String> scripts) {

   private void runGroovy(Collection<ReceiveCommand> commands, Set<String> scripts) {

      if (scripts == null || scripts.size() == 0) {

         // no Groovy scripts to execute

         return;

      }



      Binding binding = new Binding();

      binding.setVariable("gitblit", GitBlit.self());

      binding.setVariable("gitblit", gitblit);

      binding.setVariable("repository", repository);

      binding.setVariable("receivePack", this);

      binding.setVariable("user", user);