Separate management from administration in rpc servlet.

James Moger

2011-10-23 d03aff630cbcd49f02d51f08ec59ac3cf7f41d0e

 src/com/gitblit/RpcFilter.java

@@ -76,7 +76,7 @@
      boolean authenticateView = GitBlit.getBoolean(Keys.web.authenticateViewPages, false);

      boolean authenticateAdmin = GitBlit.getBoolean(Keys.web.authenticateAdminPages, true);

      

      // Wrap the HttpServletRequest with the RpcServletnRequest which

      // Wrap the HttpServletRequest with the RpcServletRequest which

      // overrides the servlet container user principal methods.

      AuthenticatedRequest authenticatedRequest = new AuthenticatedRequest(httpRequest);

      UserModel user = getUser(httpRequest);

@@ -84,9 +84,10 @@
         authenticatedRequest.setUser(user);

      }

      

      // conditionally reject rpc administration requests

      if (adminRequest && !GitBlit.getBoolean(Keys.web.enableRpcAdministration, false)) {

         logger.warn(Keys.web.enableRpcAdministration + " must be set TRUE for administrative rpc requests.");

      // conditionally reject rpc management/administration requests

      if (adminRequest && !GitBlit.getBoolean(Keys.web.enableRpcManagement, false)) {

         logger.warn(Keys.web.enableRpcManagement

               + " must be set TRUE for management/administrative rpc requests.");

         httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);

         return;

      }