From 13417cf9c6eec555b51da49742e47939d2f5715b Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Fri, 19 Oct 2012 22:47:33 -0400
Subject: [PATCH] Exclude submodules from zip downloads (issue 151)
---
src/com/gitblit/RpcFilter.java | 35 +++++++++++++++++++++++++----------
1 files changed, 25 insertions(+), 10 deletions(-)
diff --git a/src/com/gitblit/RpcFilter.java b/src/com/gitblit/RpcFilter.java
index 49df844..1de9fcc 100644
--- a/src/com/gitblit/RpcFilter.java
+++ b/src/com/gitblit/RpcFilter.java
@@ -57,28 +57,41 @@
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
- if (!GitBlit.getBoolean(Keys.web.enableRpcServlet, false)) {
+ String fullUrl = getFullUrl(httpRequest);
+ RpcRequest requestType = RpcRequest.fromName(httpRequest.getParameter("req"));
+ if (requestType == null) {
+ httpResponse.sendError(HttpServletResponse.SC_NOT_IMPLEMENTED);
+ return;
+ }
+
+ boolean adminRequest = requestType.exceeds(RpcRequest.LIST_SETTINGS);
+
+ // conditionally reject all rpc requests
+ if (!GitBlit.getBoolean(Keys.web.enableRpcServlet, true)) {
logger.warn(Keys.web.enableRpcServlet + " must be set TRUE for rpc requests.");
httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
return;
}
- String fullUrl = getFullUrl(httpRequest);
- RpcRequest requestType = RpcRequest.fromName(httpRequest.getParameter("req"));
-
- boolean adminRequest = requestType.exceeds(RpcRequest.LIST_REPOSITORIES);
-
boolean authenticateView = GitBlit.getBoolean(Keys.web.authenticateViewPages, false);
boolean authenticateAdmin = GitBlit.getBoolean(Keys.web.authenticateAdminPages, true);
- // Wrap the HttpServletRequest with the RpcServletnRequest which
+ // Wrap the HttpServletRequest with the RpcServletRequest which
// overrides the servlet container user principal methods.
AuthenticatedRequest authenticatedRequest = new AuthenticatedRequest(httpRequest);
UserModel user = getUser(httpRequest);
if (user != null) {
authenticatedRequest.setUser(user);
}
-
+
+ // conditionally reject rpc management/administration requests
+ if (adminRequest && !GitBlit.getBoolean(Keys.web.enableRpcManagement, false)) {
+ logger.warn(MessageFormat.format("{0} must be set TRUE for {1} rpc requests.",
+ Keys.web.enableRpcManagement, requestType.toString()));
+ httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
+ return;
+ }
+
// BASIC authentication challenge and response processing
if ((adminRequest && authenticateAdmin) || (!adminRequest && authenticateView)) {
if (user == null) {
@@ -92,7 +105,7 @@
return;
} else {
// check user access for request
- if (user.canAdmin || canAccess(user, requestType)) {
+ if (user.canAdmin() || canAccess(user, requestType)) {
// authenticated request permitted.
// pass processing to the restricted servlet.
newSession(authenticatedRequest, httpResponse);
@@ -122,10 +135,12 @@
private boolean canAccess(UserModel user, RpcRequest requestType) {
switch (requestType) {
+ case GET_PROTOCOL:
+ return true;
case LIST_REPOSITORIES:
return true;
default:
- return user.canAdmin;
+ return user.canAdmin();
}
}
}
\ No newline at end of file
--
Gitblit v1.9.1