From b4a63aad7f56486c164a15ae2477bcd251b0bb1b Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Tue, 18 Mar 2014 21:10:48 -0400
Subject: [PATCH] Fix authentication security hole with external providers
---
src/main/java/com/gitblit/git/PatchsetReceivePack.java | 19 +++++++++++++------
1 files changed, 13 insertions(+), 6 deletions(-)
diff --git a/src/main/java/com/gitblit/git/PatchsetReceivePack.java b/src/main/java/com/gitblit/git/PatchsetReceivePack.java
index c0ab8ae..3ec3086 100644
--- a/src/main/java/com/gitblit/git/PatchsetReceivePack.java
+++ b/src/main/java/com/gitblit/git/PatchsetReceivePack.java
@@ -163,11 +163,11 @@
/** Extracts the ticket id from the ref name */
private long getTicketId(String refName) {
+ if (refName.indexOf('%') > -1) {
+ refName = refName.substring(0, refName.indexOf('%'));
+ }
if (refName.startsWith(Constants.R_FOR)) {
String ref = refName.substring(Constants.R_FOR.length());
- if (ref.indexOf('%') > -1) {
- ref = ref.substring(0, ref.indexOf('%'));
- }
try {
return Long.parseLong(ref);
} catch (Exception e) {
@@ -350,6 +350,9 @@
continue;
}
+ LOGGER.info(MessageFormat.format("Verifying {0} push ref \"{1}\" received from {2}",
+ repository.name, cmd.getRefName(), user.username));
+
// responsible verification
String responsible = PatchsetCommand.getSingleOption(cmd, PatchsetCommand.RESPONSIBLE);
if (!StringUtils.isEmpty(responsible)) {
@@ -380,13 +383,18 @@
// watcher verification
List<String> watchers = PatchsetCommand.getOptions(cmd, PatchsetCommand.WATCH);
if (!ArrayUtils.isEmpty(watchers)) {
+ boolean verified = true;
for (String watcher : watchers) {
UserModel user = gitblit.getUserModel(watcher);
if (user == null) {
// watcher does not exist
sendRejection(cmd, "Sorry, \"{0}\" is not a valid username for the watch list!", watcher);
- continue;
+ verified = false;
+ break;
}
+ }
+ if (!verified) {
+ continue;
}
}
@@ -664,8 +672,7 @@
sendError(" 1. you created the ticket");
sendError(" 2. you created the first patchset");
sendError(" 3. you are specified as responsible for the ticket");
- sendError(" 4. you are listed as a reviewer for the ticket");
- sendError(" 5. you have push (RW) permission to {0}", repository.name);
+ sendError(" 4. you have push (RW) permissions to {0}", repository.name);
sendError("");
sendRejection(cmd, "not permitted to push to ticket {0,number,0}", ticket.number);
return null;
--
Gitblit v1.9.1