From 78753bc22f140f863aa3fe56b1c59699ca3e2fa8 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Mon, 26 Sep 2011 22:29:07 -0400
Subject: [PATCH] Protect DownloadZipServlet with an AccessRestrictionFilter.
---
src/WEB-INF/web.xml | 38 +++++++++++++++++++++++++++-----------
1 files changed, 27 insertions(+), 11 deletions(-)
diff --git a/src/WEB-INF/web.xml b/src/WEB-INF/web.xml
index c5adadd..d557725 100644
--- a/src/WEB-INF/web.xml
+++ b/src/WEB-INF/web.xml
@@ -55,6 +55,20 @@
<url-pattern>/zip/*</url-pattern>
</servlet-mapping>
+
+ <!-- Federation Servlet
+ <url-pattern> MUST match:
+ * com.gitblit.Constants.FEDERATION_PATH
+ * Wicket Filter ignorePaths parameter -->
+ <servlet>
+ <servlet-name>FederationServlet</servlet-name>
+ <servlet-class>com.gitblit.FederationServlet</servlet-class>
+ </servlet>
+ <servlet-mapping>
+ <servlet-name>FederationServlet</servlet-name>
+ <url-pattern>/federation/*</url-pattern>
+ </servlet-mapping>
+
<!-- Git Access Restriction Filter
<url-pattern> MUST match:
@@ -85,19 +99,20 @@
<url-pattern>/feed/*</url-pattern>
</filter-mapping>
- <!-- Federation Servlet
+
+ <!-- Download Zip Restriction Filter
<url-pattern> MUST match:
- * com.gitblit.Constants.FEDERATION_PATH
+ * DownloadZipServlet
+ * com.gitblit.Constants.ZIP_PATH
* Wicket Filter ignorePaths parameter -->
- <servlet>
- <servlet-name>FederationServlet</servlet-name>
- <servlet-class>com.gitblit.FederationServlet</servlet-class>
- </servlet>
- <servlet-mapping>
- <servlet-name>FederationServlet</servlet-name>
- <url-pattern>/federation/*</url-pattern>
- </servlet-mapping>
-
+ <filter>
+ <filter-name>ZipFilter</filter-name>
+ <filter-class>com.gitblit.DownloadZipFilter</filter-class>
+ </filter>
+ <filter-mapping>
+ <filter-name>ZipFilter</filter-name>
+ <url-pattern>/zip/*</url-pattern>
+ </filter-mapping>
<!-- Wicket Filter -->
<filter>
@@ -118,6 +133,7 @@
* GitFilter <url-pattern>
* GitServlet <url-pattern>
* com.gitblit.Constants.GIT_PATH
+ * Zipfilter <url-pattern>
* ZipServlet <url-pattern>
* com.gitblit.Constants.ZIP_PATH
* FederationServlet <url-pattern> -->
--
Gitblit v1.9.1