From 94dcbd617f3d06ca294d5d151390698e4bddd2cc Mon Sep 17 00:00:00 2001 From: James Moger <james.moger@gitblit.com> Date: Wed, 06 Jun 2012 17:00:21 -0400 Subject: [PATCH] Implemented default access restriction (issue 88) --- distrib/gitblit.properties | 205 ++++++++++++++++++++++++++++++++++++++++++++++++++- 1 files changed, 200 insertions(+), 5 deletions(-) diff --git a/distrib/gitblit.properties b/distrib/gitblit.properties index 17774a2..58833c0 100644 --- a/distrib/gitblit.properties +++ b/distrib/gitblit.properties @@ -2,7 +2,9 @@ # Git Servlet Settings # -# Base folder for repositories +# Base folder for repositories. +# This folder may contain bare and non-bare repositories but Gitblit will only +# allow you to push to bare repositories. # Use forward slashes even on Windows!! # e.g. c:/gitrepos # @@ -27,6 +29,23 @@ # # SINCE 0.5.0 git.enableGitServlet = true + +# Only serve/display bare repositories. +# If there are non-bare repositories in git.repositoriesFolder and this setting +# is true, they will be excluded from the ui. +# +# SINCE 0.9.0 +git.onlyAccessBareRepositories = false + +# The default access restriction for new repositories. +# Valid values are NONE, PUSH, CLONE, VIEW +# NONE = anonymous view, clone, & push +# PUSH = anonymous view & clone and authenticated push +# CLONE = anonymous view, authenticated clone & push +# VIEW = authenticated view, clone, & push +# +# SINCE 1.0.0 +git.defaultAccessRestriction = NONE # # Groovy Integration @@ -82,6 +101,21 @@ # SINCE 0.8.0 groovy.postReceiveScripts = +# Repository custom fields for Groovy Hook mechanism +# +# List of key=label pairs of custom fields to prompt for in the Edit Repository +# page. These keys are stored in the repository's git config file in the +# section [gitblit "customFields"]. Key names are alphanumeric only. These +# fields are intended to be used for the Groovy hook mechanism where a script +# can adjust it's execution based on the custom fields stored in the repository +# config. +# +# e.g. "commitMsgRegex=Commit Message Regular Expression" anotherProperty=Another +# +# SPACE-DELIMITED +# SINCE 1.0.0 +groovy.customFields = + # # Authentication Settings # @@ -107,7 +141,11 @@ # Either the full path to a user config file (users.conf) # OR the full path to a simple user properties file (users.properties) # OR a fully qualified class name that implements the IUserService interface. -# Any custom implementation must have a public default constructor. +# +# Alternative user services: +# com.gitblit.LdapUserService +# +# Any custom user service implementation must have a public default constructor. # # SINCE 0.5.0 # RESTART REQUIRED @@ -126,6 +164,121 @@ # # SINCE 0.5.0 realm.minPasswordLength = 5 + +# URL of the LDAP server. +# +# SINCE 1.0.0 +realm.ldap.server = ldap://localhost + +# Login username for LDAP searches. +# If this value is unspecified, anonymous LDAP login will be used. +# +# e.g. mydomain\\username +# +# SINCE 1.0.0 +realm.ldap.username = cn=Directory Manager + +# Login password for LDAP searches. +# +# SINCE 1.0.0 +realm.ldap.password = password + +# The LdapUserService must be backed by another user service for standard user +# and team management. +# default: users.conf +# +# SINCE 1.0.0 +# RESTART REQUIRED +realm.ldap.backingUserService = users.conf + +# Delegate team membership control to LDAP. +# +# If true, team user memberships will be specified by LDAP groups. This will +# disable team selection in Edit User and user selection in Edit Team. +# +# If false, LDAP will only be used for authentication and Gitblit will maintain +# team memberships with the *realm.ldap.backingUserService*. +# +# SINCE 1.0.0 +realm.ldap.maintainTeams = false + +# Root node for all LDAP users +# +# This is the root node from which subtree user searches will begin. +# If blank, Gitblit will search ALL nodes. +# +# SINCE 1.0.0 +realm.ldap.accountBase = OU=Users,OU=UserControl,OU=MyOrganization,DC=MyDomain + +# Filter criteria for LDAP users +# +# Query pattern to use when searching for a user account. This may be any valid +# LDAP query expression, including the standard (&) and (|) operators. +# +# Variables may be injected via the ${variableName} syntax. +# Recognized variables are: +# ${username} - The text entered as the user name +# +# SINCE 1.0.0 +realm.ldap.accountPattern = (&(objectClass=person)(sAMAccountName=${username})) + +# Root node for all LDAP groups to be used as Gitblit Teams +# +# This is the root node from which subtree team searches will begin. +# If blank, Gitblit will search ALL nodes. +# +# SINCE 1.0.0 +realm.ldap.groupBase = OU=Groups,OU=UserControl,OU=MyOrganization,DC=MyDomain + +# Filter criteria for LDAP groups +# +# Query pattern to use when searching for a team. This may be any valid +# LDAP query expression, including the standard (&) and (|) operators. +# +# Variables may be injected via the ${variableName} syntax. +# Recognized variables are: +# ${username} - The text entered as the user name +# ${dn} - The Distinguished Name of the user logged in +# +# All attributes from the LDAP User record are available. For example, if a user +# has an attribute "fullName" set to "John", "(fn=${fullName})" will be +# translated to "(fn=John)". +# +# SINCE 1.0.0 +realm.ldap.groupMemberPattern = (&(objectClass=group)(member=${dn})) + +# LDAP users or groups that should be given administrator privileges. +# +# Teams are specified with a leading '@' character. Groups with spaces in the +# name can be entered as "@team name". +# +# e.g. realm.ldap.admins = john @git_admins "@git admins" +# +# SPACE-DELIMITED +# SINCE 1.0.0 +realm.ldap.admins = @Git_Admins + +# Attribute(s) on the USER record that indicate their display (or full) name. +# Leave blank for no mapping available in LDAP. +# +# This may be a single attribute, or a string of multiple attributes. Examples: +# displayName - Uses the attribute 'displayName' on the user record +# ${personalTitle}. ${givenName} ${surname} - Will concatenate the 3 +# attributes together, with a '.' after personalTitle +# +# SINCE 1.0.0 +realm.ldap.displayName = displayName + +# Attribute(s) on the USER record that indicate their email address. +# Leave blank for no mapping available in LDAP. +# +# This may be a single attribute, or a string of multiple attributes. Examples: +# email - Uses the attribute 'email' on the user record +# ${givenName}.${surname}@gitblit.com -Will concatenate the 2 attributes +# together with a '.' and '@' creating something like first.last@gitblit.com +# +# SINCE 1.0.0 +realm.ldap.email = email # # Gitblit Web Settings @@ -175,6 +328,15 @@ # SINCE 0.5.0 web.allowZipDownloads = true +# Allow optional Lucene integration. Lucene indexing is an opt-in feature. +# A repository may specify branches to index with Lucene instead of using Git +# commit traversal. There are scenarios where you may want to completely disable +# Lucene indexing despite a repository specifying indexed branches. One such +# scenario is on a resource-constrained federated Gitblit mirror. +# +# SINCE 0.9.0 +web.allowLuceneIndexing = true + # Use Clippy (Flash solution) to provide a copy-to-clipboard button. # If false, a button with a more primitive JavaScript-based prompt box will # offer a 3-step (click, ctrl+c, enter) copy-to-clipboard alternative. @@ -223,6 +385,15 @@ # SINCE 0.5.0 web.repositoriesMessage = gitblit +# Manually set the default timezone to be used by Gitblit for display in the +# web ui. This value is independent of the JVM timezone. Specifying a blank +# value will default to the JVM timezone. +# e.g. America/New_York, US/Pacific, UTC, Europe/Berlin +# +# SINCE 0.9.0 +# RESTART REQUIRED +web.timezone = + # Use the client timezone when formatting dates. # This uses AJAX to determine the browser's timezone and may require more # server overhead because a Wicket session is created. All Gitblit pages @@ -253,7 +424,7 @@ # <http://download.oracle.com/javase/6/docs/api/java/text/SimpleDateFormat.html> # # SINCE 0.5.0 -web.datetimestampLongFormat = EEEE, MMMM d, yyyy h:mm a z +web.datetimestampLongFormat = EEEE, MMMM d, yyyy HH:mm Z # Mount URL parameters # This setting controls if pretty or parameter URLs are used. @@ -273,7 +444,8 @@ # # <https://issues.apache.org/jira/browse/WICKET-1303> # <http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.10> -# Add *org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true* to *CATALINA_OPTS* +# Add *-Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true* to your +# *CATALINA_OPTS* or to your JVM launch parameters # # SINCE 0.5.2 web.forwardSlashCharacter = / @@ -353,6 +525,12 @@ # # SINCE 0.5.0 web.itemsPerPage = 50 + +# Registered file extensions to ignore during Lucene indexing +# +# SPACE-DELIMITED +# SINCE 0.9.0 +web.luceneIgnoreExtensions = 7z arc arj bin bmp dll doc docx exe gif gz jar jpg lib lzh odg odf odt pdf ppt png so swf xcf xls xlsx zip # Registered extensions for google-code-prettify # @@ -614,6 +792,14 @@ # RESTART REQUIRED server.httpsPort = 8443 +# Port for serving an Apache JServ Protocol (AJP) 1.3 connector for integrating +# Gitblit GO into an Apache HTTP server setup. <= 0 disables this connector. +# Recommended value: 8009 +# +# SINCE 0.9.0 +# RESTART REQUIRED +server.ajpPort = 0 + # Specify the interface for Jetty to bind the standard connector. # You may specify an ip or an empty value to bind to all interfaces. # Specifying localhost will result in Gitblit ONLY listening to requests to @@ -632,6 +818,15 @@ # RESTART REQUIRED server.httpsBindInterface = localhost +# Specify the interface for Jetty to bind the AJP connector. +# You may specify an ip or an empty value to bind to all interfaces. +# Specifying localhost will result in Gitblit ONLY listening to requests to +# localhost. +# +# SINCE 0.9.0 +# RESTART REQUIRED +server.ajpBindInterface = localhost + # Password for SSL keystore. # Keystore password and certificate password must match. # This is provided for convenience, its probably more secure to set this value @@ -645,4 +840,4 @@ # # SINCE 0.5.0 # RESTART REQUIRED -server.shutdownPort = 8081 +server.shutdownPort = 8081 \ No newline at end of file -- Gitblit v1.9.1