Files
@ a444c46a0649
Branch filter:
Location: kallithea/MANIFEST.in - annotation
a444c46a0649
1.1 KiB
text/plain
middleware: fix handling of Git 'info/refs' command to give correct access control
For a pull, the Git client first sends an 'info/refs' command with a
'service=git-upload-pack' query, then it sends the actual 'git-upload-pack'
command.
For a push, the Git client first sends an 'info/refs' command with a
'service=git-receive-pack' query, then it sends the actual 'git-receive-pack'
command.
Before, the 'info/refs' commands would fall back to the default of trying to
use the action of the previous request. That seems wrong.
Instead, authorize the 'info/refs' command just like the actual command it
references.
path_info will now be checked more than before. Mainly because that is more
correct and more explicit and "better" to do it that way. It might also give
some safety.
For a pull, the Git client first sends an 'info/refs' command with a
'service=git-upload-pack' query, then it sends the actual 'git-upload-pack'
command.
For a push, the Git client first sends an 'info/refs' command with a
'service=git-receive-pack' query, then it sends the actual 'git-receive-pack'
command.
Before, the 'info/refs' commands would fall back to the default of trying to
use the action of the previous request. That seems wrong.
Instead, authorize the 'info/refs' command just like the actual command it
references.
path_info will now be checked more than before. Mainly because that is more
correct and more explicit and "better" to do it that way. It might also give
some safety.
8cea7986ed79 ff08d3cf9aef ff08d3cf9aef ff08d3cf9aef 8cea7986ed79 ff08d3cf9aef ff08d3cf9aef ff08d3cf9aef ff08d3cf9aef 8cea7986ed79 ff08d3cf9aef 8cea7986ed79 8cea7986ed79 8cea7986ed79 2d7a94f3eaae 0e6035a85980 7894a440e134 ff08d3cf9aef 8cea7986ed79 19a9f02443c8 ff08d3cf9aef ff08d3cf9aef 7e5f8c12a3fc ff08d3cf9aef ff08d3cf9aef 8cea7986ed79 8cea7986ed79 ff08d3cf9aef 8cea7986ed79 | include .coveragerc
include Apache-License-2.0.txt
include CONTRIBUTORS
include COPYING
include Jenkinsfile
include LICENSE-MERGELY.html
include LICENSE.md
include MIT-Permissive-License.txt
include README.rst
include dev_requirements.txt
include development.ini
include pytest.ini
include requirements.txt
include tox.ini
recursive-include docs *
recursive-include init.d *
recursive-include kallithea/alembic *
include kallithea/bin/ldap_sync.conf
include kallithea/lib/paster_commands/template.ini.mako
recursive-include kallithea/front-end *
recursive-include kallithea/i18n *
recursive-include kallithea/public *
recursive-include kallithea/templates *
recursive-include kallithea/tests/fixtures *
recursive-include kallithea/tests/scripts *
include kallithea/tests/models/test_dump_html_mails.ref.html
include kallithea/tests/performance/test_vcs.py
include kallithea/tests/vcs/aconfig
recursive-include scripts *
|