Fix authentication security hole with external providers

James Moger

2014-03-18 b4a63aad7f56486c164a15ae2477bcd251b0bb1b

 src/main/java/com/gitblit/manager/GitblitManager.java

@@ -33,7 +33,12 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.eclipse.jgit.api.CloneCommand;
import org.eclipse.jgit.api.FetchCommand;
import org.eclipse.jgit.api.Git;
import org.eclipse.jgit.lib.Ref;
import org.eclipse.jgit.lib.Repository;
import org.eclipse.jgit.transport.RefSpec;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

@@ -50,6 +55,7 @@
import com.gitblit.models.FederationSet;
import com.gitblit.models.ForkModel;
import com.gitblit.models.GitClientApplication;
import com.gitblit.models.Mailing;
import com.gitblit.models.Metric;
import com.gitblit.models.ProjectModel;
import com.gitblit.models.RegistrantAccessPermission;
@@ -61,9 +67,9 @@
import com.gitblit.models.SettingModel;
import com.gitblit.models.TeamModel;
import com.gitblit.models.UserModel;
import com.gitblit.tickets.ITicketService;
import com.gitblit.utils.ArrayUtils;
import com.gitblit.utils.HttpUtils;
import com.gitblit.utils.JGitUtils;
import com.gitblit.utils.JsonUtils;
import com.gitblit.utils.ObjectCache;
import com.gitblit.utils.StringUtils;
@@ -157,7 +163,33 @@

      // clone the repository
      try {
         JGitUtils.cloneRepository(repositoryManager.getRepositoriesFolder(), cloneName, fromUrl, true, null);
         Repository canonical = getRepository(repository.name);
         File folder = new File(repositoryManager.getRepositoriesFolder(), cloneName);
         CloneCommand clone = new CloneCommand();
         clone.setBare(true);

         // fetch branches with exclusions
         Collection<Ref> branches = canonical.getRefDatabase().getRefs(Constants.R_HEADS).values();
         List<String> branchesToClone = new ArrayList<String>();
         for (Ref branch : branches) {
            String name = branch.getName();
            if (name.startsWith(Constants.R_TICKET)) {
               // exclude ticket branches
               continue;
            }
            branchesToClone.add(name);
         }
         clone.setBranchesToClone(branchesToClone);
         clone.setURI(fromUrl);
         clone.setDirectory(folder);
         Git git = clone.call();

         // fetch tags
         FetchCommand fetch  = git.fetch();
         fetch.setRefSpecs(new RefSpec("+refs/tags/*:refs/tags/*"));
         fetch.call();

         git.getRepository().close();
      } catch (Exception e) {
         throw new GitBlitException(e);
      }
@@ -172,7 +204,8 @@
      if (!ArrayUtils.isEmpty(repository.owners)) {
         for (String owner : repository.owners) {
            UserModel originOwner = userManager.getUserModel(owner);
            if (originOwner != null) {
            if (originOwner != null && !originOwner.canClone(cloneModel)) {
               // origin owner can't yet clone fork, grant explicit clone access
               originOwner.setRepositoryPermission(cloneName, AccessPermission.CLONE);
               reviseUser(originOwner.username, originOwner);
            }
@@ -185,8 +218,8 @@
      for (String name : users) {
         if (!name.equalsIgnoreCase(user.username)) {
            UserModel cloneUser = userManager.getUserModel(name);
            if (cloneUser.canClone(repository)) {
               // origin user can clone origin, grant clone access to fork
            if (cloneUser.canClone(repository) && !cloneUser.canClone(cloneModel)) {
               // origin user can't yet clone fork, grant explicit clone access
               cloneUser.setRepositoryPermission(cloneName, AccessPermission.CLONE);
            }
            cloneUsers.add(cloneUser);
@@ -199,8 +232,8 @@
      List<TeamModel> cloneTeams = new ArrayList<TeamModel>();
      for (String name : teams) {
         TeamModel cloneTeam = userManager.getTeamModel(name);
         if (cloneTeam.canClone(repository)) {
            // origin team can clone origin, grant clone access to fork
         if (cloneTeam.canClone(repository) && !cloneTeam.canClone(cloneModel)) {
            // origin team can't yet clone fork, grant explicit clone access
            cloneTeam.setRepositoryPermission(cloneName, AccessPermission.CLONE);
         }
         cloneTeams.add(cloneTeam);
@@ -481,6 +514,15 @@
      }
   }

   /**
    * Throws an exception if trying to get a ticket service.
    *
    */
   @Override
   public ITicketService getTicketService() {
      throw new RuntimeException("This class does not have a ticket service!");
   }

   /*
    * ISTOREDSETTINGS
    *
@@ -583,28 +625,13 @@
   }

   @Override
   public void sendMail(String subject, String message, String... toAddresses) {
      notificationManager.sendMail(subject, message, toAddresses);
   }

   @Override
   public void sendHtmlMail(String subject, String message, Collection<String> toAddresses) {
      notificationManager.sendHtmlMail(subject, message, toAddresses);
   }

   @Override
   public void sendHtmlMail(String subject, String message, String... toAddresses) {
      notificationManager.sendHtmlMail(subject, message, toAddresses);
   }

   @Override
   public void sendHtmlMail(String from, String subject, String message, Collection<String> toAddresses) {
      notificationManager.sendHtmlMail(from, subject, message, toAddresses);
   }

   @Override
   public void sendHtmlMail(String from, String subject, String message, String... toAddresses) {
      notificationManager.sendHtmlMail(from, subject, message, toAddresses);
   public void send(Mailing mail) {
      notificationManager.send(mail);
   }

   /*
@@ -1112,4 +1139,19 @@
   public boolean deletePendingFederationProposal(FederationProposal proposal) {
      return federationManager.deletePendingFederationProposal(proposal);
   }

   @Override
   public void closeAll() {
      repositoryManager.closeAll();
   }

   @Override
   public void close(String repository) {
      repositoryManager.close(repository);
   }

   @Override
   public boolean isIdle(Repository repository) {
      return repositoryManager.isIdle(repository);
   }
}