From 90eb5a08ddd6a3a246e8b73da9524c304838928a Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Fri, 05 Sep 2014 19:28:24 -0400
Subject: [PATCH] Merged #167 "Do not let new forks inadvertently disclose repository contents"
---
src/main/java/com/gitblit/manager/GitblitManager.java | 7 +++++++
1 files changed, 7 insertions(+), 0 deletions(-)
diff --git a/src/main/java/com/gitblit/manager/GitblitManager.java b/src/main/java/com/gitblit/manager/GitblitManager.java
index 98ad33e..b9ae122 100644
--- a/src/main/java/com/gitblit/manager/GitblitManager.java
+++ b/src/main/java/com/gitblit/manager/GitblitManager.java
@@ -216,6 +216,13 @@
RepositoryModel cloneModel = repository.cloneAs(cloneName);
// owner has REWIND/RW+ permissions
cloneModel.addOwner(user.username);
+
+ // ensure initial access restriction of the fork
+ // is not lower than the source repository (issue-495/ticket-167)
+ if (repository.accessRestriction.exceeds(cloneModel.accessRestriction)) {
+ cloneModel.accessRestriction = repository.accessRestriction;
+ }
+
repositoryManager.updateRepositoryModel(cloneName, cloneModel, false);
// add the owner of the source repository to the clone's access list
--
Gitblit v1.9.1