From 0145db444fdf75599de30cce2e3dbbc3f048d632 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Tue, 18 Mar 2014 21:13:57 -0400
Subject: [PATCH] Merged #35 "Fix authentication security hole with external providers"
---
src/main/java/com/gitblit/git/PatchsetReceivePack.java | 18 ++++++++++++------
1 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/src/main/java/com/gitblit/git/PatchsetReceivePack.java b/src/main/java/com/gitblit/git/PatchsetReceivePack.java
index d3d0b1d..3ec3086 100644
--- a/src/main/java/com/gitblit/git/PatchsetReceivePack.java
+++ b/src/main/java/com/gitblit/git/PatchsetReceivePack.java
@@ -163,11 +163,11 @@
/** Extracts the ticket id from the ref name */
private long getTicketId(String refName) {
+ if (refName.indexOf('%') > -1) {
+ refName = refName.substring(0, refName.indexOf('%'));
+ }
if (refName.startsWith(Constants.R_FOR)) {
String ref = refName.substring(Constants.R_FOR.length());
- if (ref.indexOf('%') > -1) {
- ref = ref.substring(0, ref.indexOf('%'));
- }
try {
return Long.parseLong(ref);
} catch (Exception e) {
@@ -350,6 +350,9 @@
continue;
}
+ LOGGER.info(MessageFormat.format("Verifying {0} push ref \"{1}\" received from {2}",
+ repository.name, cmd.getRefName(), user.username));
+
// responsible verification
String responsible = PatchsetCommand.getSingleOption(cmd, PatchsetCommand.RESPONSIBLE);
if (!StringUtils.isEmpty(responsible)) {
@@ -380,13 +383,18 @@
// watcher verification
List<String> watchers = PatchsetCommand.getOptions(cmd, PatchsetCommand.WATCH);
if (!ArrayUtils.isEmpty(watchers)) {
+ boolean verified = true;
for (String watcher : watchers) {
UserModel user = gitblit.getUserModel(watcher);
if (user == null) {
// watcher does not exist
sendRejection(cmd, "Sorry, \"{0}\" is not a valid username for the watch list!", watcher);
- continue;
+ verified = false;
+ break;
}
+ }
+ if (!verified) {
+ continue;
}
}
@@ -484,8 +492,6 @@
* @return the patchset command
*/
private PatchsetCommand preparePatchset(ReceiveCommand cmd) {
- LOGGER.info(MessageFormat.format("Preparing {0} patchset command for \"{1}\" received from {2}",
- repository.name, cmd.getRefName(), user.username));
String branch = getIntegrationBranch(cmd.getRefName());
long number = getTicketId(cmd.getRefName());
--
Gitblit v1.9.1