kallithea Changeset - 2632a49cb402

Changeset - 2632a49cb402

Parent rev.

Child rev.

[Not reviewed]

beta

0 1 0

Marcin Kuzminski - 14 years ago 2012-03-02 20:53:19
marcin@python-works.com

fixes issue #372
- improved detection of git operation, that caused to return bad data and created a security bug

1 file changed with 12 insertions and 9 deletions:

rhodecode/lib/middleware/simplegit.py

0 comments (0 inline, 0 general)

rhodecode/lib/middleware/simplegit.py

➞

Show inline comments

@@ @@ -118,12 +118,13 @@ class SimpleGit(BaseVCSController): @@
         #======================================================================
         action = self.__get_action(environ)
         #======================================================================
         # CHECK ANONYMOUS PERMISSION
         #======================================================================
         if action in ['pull', 'push']:
             anonymous_user = self.__get_user('default')
             username = anonymous_user.username
             anonymous_perm = self._check_permission(action, anonymous_user,
                                                     repo_name)
@@ @@ -166,21 +167,19 @@ class SimpleGit(BaseVCSController): @@
                     except:
                         log.error(traceback.format_exc())
                         return HTTPInternalServerError()(environ,
                                                          start_response)
                     #check permissions for this repository
                     perm = self._check_permission(action, user,
                                                    repo_name)
                     perm = self._check_permission(action, user, repo_name)
                     if perm is not True:
                         return HTTPForbidden()(environ, start_response)
         #===================================================================
         # GIT REQUEST HANDLING
         #===================================================================
         repo_path = safe_str(os.path.join(self.basepath, repo_name))
         log.debug('Repository path is %s' % repo_path)
         # quick check if that dir exists...
         if is_valid_repo(repo_name, self.basepath) is False:
             return HTTPNotFound()(environ, start_response)
@@ @@ -200,13 +199,12 @@ class SimpleGit(BaseVCSController): @@
         """
         Make an wsgi application using dulserver
         :param repo_name: name of the repository
         :param repo_path: full path to the repository
         """
         _d = {'/' + repo_name: Repo(repo_path)}
         backend = dulserver.DictBackend(_d)
         gitserve = HTTPGitApplication(backend)
         return gitserve
@@ @@ -226,22 +224,27 @@ class SimpleGit(BaseVCSController): @@
         return repo_name
     def __get_user(self, username):
         return User.get_by_username(username)
     def __get_action(self, environ):
         """Maps git request commands into a pull or push command.
         """
         Maps git request commands into a pull or push command.
         :param environ:
         """
         service = environ['QUERY_STRING'].split('=')
         if len(service) > 1:
             service_cmd = service[1]
             mapping = {
                 'git-receive-pack': 'push',
                 'git-upload-pack': 'pull',
+            }
             return mapping.get(service_cmd,
                                service_cmd if service_cmd else 'other')
             op = mapping[service_cmd]
             self._git_stored_op = op
             return op
         else:
             return 'other'
             # try to fallback to stored variable as we don't know if the last
             # operation is pull/push
             op = getattr(self, '_git_stored_op', 'pull')
         return op

0 comments (0 inline, 0 general)