From e9838a83ce2893476a14b27236dd50bb4ea09453 Mon Sep 17 00:00:00 2001 From: Unknwon Date: Sat, 4 Mar 2017 21:26:32 -0500 Subject: [PATCH] routers/repo/http: only prompt HTTP Basic Authentication when intended Sometimes user could simply request wrong URL, but if that wrong URL has nothing related Git HTTP operations, HTTP Basic Authentication should not prompted. Instead, clean 404 page should be presented. The patch also supports Git HTTP operations without '.git' suffix to the repository name, which addresses #4226 and #4189. --- cmd/web.go | 5 ++++- gogs.go | 2 +- modules/bindata/bindata.go | 46 +++++++++++++++++++------------------- routers/repo/http.go | 10 +++++++++ templates/.VERSION | 2 +- 5 files changed, 39 insertions(+), 26 deletions(-) diff --git a/cmd/web.go b/cmd/web.go index 73e4ee495..b6aa2dd7e 100644 --- a/cmd/web.go +++ b/cmd/web.go @@ -623,11 +623,14 @@ func runWeb(ctx *cli.Context) error { m.Group("/:reponame", func() { m.Head("/tasks/trigger", repo.TriggerTask) }) - // Use the regexp to match the repository name validation + // Use the regexp to match the repository name + // Duplicated routes to enable different ways of accessing same set of URLs, + // e.g. with or without ".git" suffix. m.Group("/:reponame([\\d\\w-_\\.]+\\.git$)", func() { m.Get("", ignSignIn, context.RepoAssignment(true), context.RepoRef(), repo.Home) m.Route("/*", "GET,POST", ignSignInAndCsrf, repo.HTTPContexter(), repo.HTTP) }) + m.Route("/:reponame/*", "GET,POST", ignSignInAndCsrf, repo.HTTPContexter(), repo.HTTP) }) // ***** END: Repository ***** diff --git a/gogs.go b/gogs.go index 23fae832b..bcc753ac4 100644 --- a/gogs.go +++ b/gogs.go @@ -16,7 +16,7 @@ import ( "github.com/gogits/gogs/modules/setting" ) -const APP_VER = "0.10.4.0303" +const APP_VER = "0.10.5.0304" func init() { setting.AppVer = APP_VER diff --git a/modules/bindata/bindata.go b/modules/bindata/bindata.go index 7d808cf45..98a37f4e5 100644 --- a/modules/bindata/bindata.go +++ b/modules/bindata/bindata.go @@ -100,7 +100,6 @@ // conf/gitignore/Node // conf/gitignore/NotepadPP // conf/gitignore/OCaml -// conf/gitignore/OSX // conf/gitignore/Objective-C // conf/gitignore/Opa // conf/gitignore/OpenCart @@ -166,6 +165,7 @@ // conf/gitignore/Yii // conf/gitignore/ZendFramework // conf/gitignore/Zephir +// conf/gitignore/macOS // conf/label/Default // conf/license/Abstyles License // conf/license/Academic Free License v1.1 @@ -2292,26 +2292,6 @@ func confGitignoreOcaml() (*asset, error) { return a, nil } -var _confGitignoreOsx = []byte("\x1f\x8b\x08\x00\x00\x09\x6e\x88\x00\xff\x44\x90\xc1\x6a\x2b\x31\x0c\x45\xf7\x86\xfc\x83\xe0\xed\x1e\x3c\x93\xf7\x09\x29\x43\x20\x50\xda\xd2\x09\x59\x15\x82\x33\x73\x53\x9b\xd8\x96\x91\x34\x13\xf2\xf7\x65\x42\xda\xee\x84\xae\x38\x3a\x5c\xdf\xf5\xc7\xde\x58\xe0\xfc\xa6\xb5\x8c\x8e\xa7\x53\x86\xf3\xcf\xfd\xeb\x0c\x91\x34\xc2\xb9\x3f\xb4\x1b\xb8\x52\x99\xd4\x08\x75\xa4\x6b\xb2\x48\x76\x65\xfa\x10\xb7\x24\xab\xd5\x72\xb3\x8f\x53\x39\xd5\x90\xb2\x3a\x7f\xfc\xbb\x6c\xb6\x29\x43\xc9\x62\x30\x2a\xe9\x33\x1a\x85\xd6\x10\x84\x52\x25\x8b\x20\x61\x36\xe2\x33\x05\x9a\x39\x4f\x05\xce\x77\x3c\x4c\x05\xd5\xde\x31\x27\x4d\x5c\xf5\xdf\xe1\xff\x7a\xed\xfc\x59\x31\xa3\x9a\x8e\xce\xf7\x8d\x2d\x2f\xb0\x47\xb4\x47\x69\x2c\x41\x6e\x3b\x43\x51\xe7\xf7\x12\x34\x42\x9d\x3f\xdc\x99\x8b\x9e\x4f\x43\xd5\xc5\xa7\x4b\x82\xc1\x58\x12\x94\x1a\x1b\xaa\xa5\x90\xf3\x8d\x06\x41\x30\x8c\xc4\x95\x04\x85\x0d\xb4\xd9\xbe\x91\xc6\xf0\xdb\xca\xd3\xf7\x00\xbd\x18\x37\xf7\x02\xbb\xb2\x5c\xe8\xfe\x8e\xb6\x9c\x47\x88\xfb\x71\xa1\x87\x4c\x68\x63\xd2\x8b\xfb\x0a\x00\x00\xff\xff\x2b\xec\x6b\x35\x64\x01\x00\x00") - -func confGitignoreOsxBytes() ([]byte, error) { - return bindataRead( - _confGitignoreOsx, - "conf/gitignore/OSX", - ) -} - -func confGitignoreOsx() (*asset, error) { - bytes, err := confGitignoreOsxBytes() - if err != nil { - return nil, err - } - - info := bindataFileInfo{name: "conf/gitignore/OSX", size: 356, mode: os.FileMode(420), modTime: time.Unix(1444419364, 0)} - a := &asset{bytes: bytes, info: info} - return a, nil -} - var _confGitignoreObjectiveC = []byte("\x1f\x8b\x08\x00\x00\x09\x6e\x88\x00\xff\x5c\x52\xc1\x6e\xdc\x3a\x0c\xbc\xeb\x2b\xf8\x60\xe0\x1d\x16\x91\x8d\xa6\xb7\xbd\xb5\x1b\xa0\xbd\xa5\x40\x81\xb6\x57\x59\xa4\x6d\x6e\x6d\xd1\x90\x28\xef\xe6\xef\x0b\xc9\xc9\x6e\xda\x8b\x01\xcf\x90\x1c\x6a\x38\x0d\xfc\xf2\x82\x64\x1a\xd3\xc0\xc8\xca\x63\x90\x48\xe0\x25\x68\xe4\x3e\xab\xc4\x74\x84\x48\x0b\x2d\x3d\x45\x50\x81\xbc\xa2\x53\x82\x2f\xb3\xf4\x6e\xee\x6a\x6f\x7b\xeb\x7b\x80\xe7\xfe\x4c\x5e\x79\x23\x7b\xba\xc3\xf0\x3f\x7c\xbf\xf0\xa0\x77\xc4\x98\xa6\x81\xcf\x99\x67\x84\x91\x02\x45\xa7\x84\xa6\x2f\xff\x9d\x79\xa2\xc8\x1b\xe1\x93\x53\x57\xcb\x7e\xb8\xc8\x92\x13\x24\x52\xe5\x30\x26\x73\x68\xd7\xfe\x9a\x13\x45\xf3\x1f\xd2\xe0\xf2\xac\x37\xe0\xd0\x2e\x82\xf4\x61\xfb\x78\xa7\xde\x80\x9d\x7a\xfc\x97\x7a\xac\xd4\x4a\x31\xad\xfb\xe2\xef\x0b\xfe\x86\xaf\xbe\x68\xe0\xdb\x5e\xcf\x3a\x55\xc5\xab\xf7\x13\xf9\xdf\x92\xb5\x6a\x6c\x84\xd6\x25\x46\xaa\x54\xe9\x48\xea\x74\xff\x4b\x7e\xe9\xe7\x4c\x6b\xe4\xa0\xfb\x8c\xfe\x6c\x4f\x5d\x35\x07\x8a\x12\x0f\xec\xcd\xa1\x9d\x16\xb7\x9a\x43\xcb\x6b\x51\x82\x93\x78\x71\xdf\x04\x53\x3d\xd2\x4f\x82\x48\x5e\x96\x85\x02\x82\x1b\x1d\x87\xa4\xe0\x10\x39\x8c\xa0\x13\x41\x29\x04\xe4\x48\x5e\x25\xbe\x94\x93\xbd\x48\x8e\x70\xf7\xbe\x85\xaf\x72\xa1\x8d\xa2\x69\x0a\x05\x69\x92\x3c\x23\x9c\x33\x8e\x04\x83\xc4\x5a\x9f\x68\x1e\x1e\xea\xbc\x35\x4a\x02\x17\xb0\x64\x22\x81\x8b\x04\x0b\x05\x65\x09\x84\xe0\xf4\x68\x1a\x98\x54\xd7\x63\xd7\x8d\x99\x91\x52\xeb\xcb\xb6\xab\x60\x6a\x25\x8e\x5d\x4e\x1c\x5e\xbf\xf6\xce\x4c\xba\xcc\xcd\xae\x6b\xd9\x56\xfb\xac\x4e\x64\x0b\x69\x6f\xbb\x5b\x0e\x2a\x36\x49\x8e\x9e\x6c\x4d\xa4\xcc\xc5\x82\xf2\xc2\xae\x1a\xe3\xa2\x4e\x6e\xdc\xc3\xfb\x09\x11\x74\xe2\x04\x33\x07\x02\x1e\xea\xdb\x2e\x2e\x68\xb1\xc0\x6d\xc2\x08\x55\xa8\xf8\xc4\x01\xf6\xb1\x50\xf2\x0b\x43\x94\xe5\x36\x0c\x90\x56\x0a\x48\xc1\x33\xa5\xf6\x9d\x4a\x77\x7a\x3d\x73\x32\xe6\x86\xd5\x0c\x9b\x3f\x01\x00\x00\xff\xff\x4e\x18\xce\x5e\x45\x03\x00\x00") func confGitignoreObjectiveCBytes() ([]byte, error) { @@ -3612,6 +3592,26 @@ func confGitignoreZephir() (*asset, error) { return a, nil } +var _confGitignoreMacos = []byte("\x1f\x8b\x08\x00\x00\x09\x6e\x88\x00\xff\x4c\x90\x41\x6b\x2b\x31\x0c\x84\xef\x06\xff\x07\xc1\xbb\x3d\x78\x4b\xde\x4f\x48\x59\x02\x81\xd2\x96\x6e\xc8\xa9\x10\x9c\x5d\xa5\x16\xb1\x2d\x23\x69\x37\xe4\xdf\x17\x27\x24\xf4\x36\xf6\x0c\x33\x1f\xea\xfa\xe1\x30\x18\x0b\x7a\xd7\xad\x6b\x4d\xd8\xf3\x7c\x4c\xed\xf5\x3a\xbc\x2f\x28\x42\x13\x7a\xe7\xdd\x1f\xd8\x8e\x5c\x20\xcf\x6a\x80\x65\x82\x0b\x59\x04\xbb\x30\x7c\x89\x77\xcd\x6a\xa1\x16\xdb\xc5\x39\x1f\x4b\xa0\xa4\xde\x75\x87\xbf\xf7\xcf\x0d\x25\x54\xb0\x18\x0c\x32\x7d\x47\x83\x50\x2b\x06\x01\x2a\x60\x11\x41\x98\x0d\xf8\x04\x01\x16\x4e\x73\x6e\xeb\x3d\x8f\x73\xc6\x62\x9f\xb8\x90\x12\x17\xfd\xb7\xff\xbf\x5a\x79\xd7\x9d\x14\x17\x2c\xa6\x93\x77\xdd\x50\xd9\x52\xeb\x7b\x98\x3b\xcc\x95\x25\xc8\x75\x6b\x98\x1b\xc0\x4e\x82\x46\x6c\x6a\x7f\x6b\x6e\xa4\x1d\x8d\x45\xef\x5c\x3d\x09\x8e\xc6\x42\xa8\x50\xd9\xb0\x18\x85\x94\xae\x30\x0a\x06\xc3\x09\xb8\x80\x60\x66\x43\x58\x6f\x3e\x40\x63\xf8\x75\xa7\x97\xa7\x42\x3d\x1b\x57\xef\xde\xd0\x2e\x2c\x67\xb8\x8d\xc2\x86\xd3\x84\xe2\xdd\x93\x09\x1e\x50\xa1\x4e\xa4\x67\xef\x7e\x02\x00\x00\xff\xff\x92\xab\x50\x88\x7c\x01\x00\x00") + +func confGitignoreMacosBytes() ([]byte, error) { + return bindataRead( + _confGitignoreMacos, + "conf/gitignore/macOS", + ) +} + +func confGitignoreMacos() (*asset, error) { + bytes, err := confGitignoreMacosBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "conf/gitignore/macOS", size: 380, mode: os.FileMode(420), modTime: time.Unix(1488676657, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + var _confLabelDefault = []byte("\x1f\x8b\x08\x00\x00\x09\x6e\x88\x00\xff\x1c\xcc\x51\x0e\x82\x30\x0c\x87\xf1\xf7\x9e\xa2\x49\x2f\xc0\xd4\x00\xd7\xd9\xba\x3f\xd2\x64\x16\x8c\x9d\x78\x7c\x03\xbf\xef\xfd\x13\x60\x98\x86\xc4\xa5\x3f\x49\xf4\xc2\xb5\xef\xcd\x34\x07\x48\xe6\x47\x19\x51\x18\xbe\x66\x57\xbc\xe0\x41\x92\x6e\x73\x1e\x94\x57\xb4\x9d\x8f\xec\x81\x4a\x82\xf1\x8c\xcd\xbf\xb9\x59\x3d\x4f\xf7\x34\x29\xbf\x3b\x3e\x61\x9b\x93\x2c\x17\x3e\x36\x8f\xc5\x7e\xf4\x0f\x00\x00\xff\xff\xce\x7a\x45\xfa\x77\x00\x00\x00") func confLabelDefaultBytes() ([]byte, error) { @@ -4944,7 +4944,6 @@ var _bindata = map[string]func() (*asset, error){ "conf/gitignore/Node": confGitignoreNode, "conf/gitignore/NotepadPP": confGitignoreNotepadpp, "conf/gitignore/OCaml": confGitignoreOcaml, - "conf/gitignore/OSX": confGitignoreOsx, "conf/gitignore/Objective-C": confGitignoreObjectiveC, "conf/gitignore/Opa": confGitignoreOpa, "conf/gitignore/OpenCart": confGitignoreOpencart, @@ -5010,6 +5009,7 @@ var _bindata = map[string]func() (*asset, error){ "conf/gitignore/Yii": confGitignoreYii, "conf/gitignore/ZendFramework": confGitignoreZendframework, "conf/gitignore/Zephir": confGitignoreZephir, + "conf/gitignore/macOS": confGitignoreMacos, "conf/label/Default": confLabelDefault, "conf/license/Abstyles License": confLicenseAbstylesLicense, "conf/license/Academic Free License v1.1": confLicenseAcademicFreeLicenseV11, @@ -5213,7 +5213,6 @@ var _bintree = &bintree{nil, map[string]*bintree{ "Node": &bintree{confGitignoreNode, map[string]*bintree{}}, "NotepadPP": &bintree{confGitignoreNotepadpp, map[string]*bintree{}}, "OCaml": &bintree{confGitignoreOcaml, map[string]*bintree{}}, - "OSX": &bintree{confGitignoreOsx, map[string]*bintree{}}, "Objective-C": &bintree{confGitignoreObjectiveC, map[string]*bintree{}}, "Opa": &bintree{confGitignoreOpa, map[string]*bintree{}}, "OpenCart": &bintree{confGitignoreOpencart, map[string]*bintree{}}, @@ -5279,6 +5278,7 @@ var _bintree = &bintree{nil, map[string]*bintree{ "Yii": &bintree{confGitignoreYii, map[string]*bintree{}}, "ZendFramework": &bintree{confGitignoreZendframework, map[string]*bintree{}}, "Zephir": &bintree{confGitignoreZephir, map[string]*bintree{}}, + "macOS": &bintree{confGitignoreMacos, map[string]*bintree{}}, }}, "label": &bintree{nil, map[string]*bintree{ "Default": &bintree{confLabelDefault, map[string]*bintree{}}, diff --git a/routers/repo/http.go b/routers/repo/http.go index e67a5b08e..c7dbe876c 100644 --- a/routers/repo/http.go +++ b/routers/repo/http.go @@ -76,6 +76,16 @@ func HTTPContexter() macaron.Handler { return } + // In case user requested a wrong URL and not intended to access Git objects. + action := ctx.Params("*") + if !strings.Contains(action, "git-") && + !strings.Contains(action, "info/") && + !strings.Contains(action, "HEAD") && + !strings.Contains(action, "objects/") { + ctx.NotFound() + return + } + // Handle HTTP Basic Authentication authHead := ctx.Req.Header.Get("Authorization") if len(authHead) == 0 { diff --git a/templates/.VERSION b/templates/.VERSION index b3c57e4d1..3d68c3cb1 100644 --- a/templates/.VERSION +++ b/templates/.VERSION @@ -1 +1 @@ -0.10.4.0303 \ No newline at end of file +0.10.5.0304 \ No newline at end of file