Only show SSH clone URL if signed in (#2169) (#2170)

* Add configuration flag SSH_EXPOSE_ANONYMOUS

If this flag (default True) is set to false, the SSH clone URL will only be exposed if the current user is signed in.

* Default SSH exposure set to false

To match GitHub and for security reasons, SSH URL exposure is disabled by default.
In addition to that. minor code changes have been applied.

Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>
* Add integration tests

* Hide clone button neither HTTP and SSH is enabled

Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>

diff --git a/conf/app.ini b/conf/app.ini
index 8f04435b5ff040c5765b147cc301d5c470de981b..bb0654e2e27d37a05a669c8c6d301564c2aa60e0 100644 (file)
--- a/conf/app.ini
+++ b/conf/app.ini
@@ -126,6 +126,8 @@ SSH_KEY_TEST_PATH =
 SSH_KEYGEN_PATH = ssh-keygen
 ; Enable SSH Authorized Key Backup when rewriting all keys, default is true
 SSH_BACKUP_AUTHORIZED_KEYS = true
+; Enable exposure of SSH clone URL to anonymous visitors, default is false
+SSH_EXPOSE_ANONYMOUS = false
 ; Indicate whether to check minimum key size with corresponding type
 MINIMUM_KEY_SIZE_CHECK = false
 ; Disable CDN even in "prod" mode

diff --git a/integrations/repo_test.go b/integrations/repo_test.go
index 004156b446f35fc8b323509e3e2ed8905a7503d7..f5ba4d8d82e63d0137eaad90d759fc652c2b136e 100644 (file)
--- a/integrations/repo_test.go
+++ b/integrations/repo_test.go
@@ -5,8 +5,13 @@
 package integrations
 
 import (
+       "fmt"
        "net/http"
        "testing"
+
+       "code.gitea.io/gitea/modules/setting"
+
+       "github.com/stretchr/testify/assert"
 )
 
 func TestViewRepo(t *testing.T) {
@@ -37,3 +42,35 @@ func TestViewRepo3(t *testing.T) {
        session := loginUser(t, "user3")
        session.MakeRequest(t, req, http.StatusOK)
 }
+
+func TestViewRepo1CloneLinkAnonymous(t *testing.T) {
+       prepareTestEnv(t)
+
+       req := NewRequest(t, "GET", "/user2/repo1")
+       resp := MakeRequest(t, req, http.StatusOK)
+
+       htmlDoc := NewHTMLParser(t, resp.Body)
+       link, exists := htmlDoc.doc.Find("#repo-clone-https").Attr("data-link")
+       assert.True(t, exists, "The template has changed")
+       assert.Equal(t, setting.AppURL+"user2/repo1.git", link)
+       _, exists = htmlDoc.doc.Find("#repo-clone-ssh").Attr("data-link")
+       assert.False(t, exists)
+}
+
+func TestViewRepo1CloneLinkAuthorized(t *testing.T) {
+       prepareTestEnv(t)
+
+       session := loginUser(t, "user2")
+
+       req := NewRequest(t, "GET", "/user2/repo1")
+       resp := session.MakeRequest(t, req, http.StatusOK)
+
+       htmlDoc := NewHTMLParser(t, resp.Body)
+       link, exists := htmlDoc.doc.Find("#repo-clone-https").Attr("data-link")
+       assert.True(t, exists, "The template has changed")
+       assert.Equal(t, setting.AppURL+"user2/repo1.git", link)
+       link, exists = htmlDoc.doc.Find("#repo-clone-ssh").Attr("data-link")
+       assert.True(t, exists, "The template has changed")
+       sshURL := fmt.Sprintf("%s@%s:user2/repo1.git", setting.RunUser, setting.SSH.Domain)
+       assert.Equal(t, sshURL, link)
+}

diff --git a/modules/context/repo.go b/modules/context/repo.go
index e46170b76de851dd0e2e775fd4b5c189ea65e3f7..d636496f5010d7bce282339146405a6ef070f48e 100644 (file)
--- a/modules/context/repo.go
+++ b/modules/context/repo.go
@@ -285,6 +285,7 @@ func RepoAssignment() macaron.Handler {
                ctx.Data["IsRepositoryWriter"] = ctx.Repo.IsWriter()
 
                ctx.Data["DisableSSH"] = setting.SSH.Disabled
+               ctx.Data["ExposeAnonSSH"] = setting.SSH.ExposeAnonymous
                ctx.Data["DisableHTTP"] = setting.Repository.DisableHTTPGit
                ctx.Data["CloneLink"] = repo.CloneLink()
                ctx.Data["WikiCloneLink"] = repo.WikiCloneLink()

diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index f24a87653bf5f99bab7dd3e95bbf71be33a826fd..82187e81be7ea9e23f56f3019c933f7bc6cb7780 100644 (file)
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -99,6 +99,7 @@ var (
                AuthorizedKeysBackup bool           `ini:"SSH_AUTHORIZED_KEYS_BACKUP"`
                MinimumKeySizeCheck  bool           `ini:"-"`
                MinimumKeySizes      map[string]int `ini:"-"`
+               ExposeAnonymous      bool           `ini:"SSH_EXPOSE_ANONYMOUS"`
        }{
                Disabled:           false,
                StartBuiltinServer: false,
@@ -707,6 +708,7 @@ func NewContext() {
                }
        }
        SSH.AuthorizedKeysBackup = sec.Key("SSH_AUTHORIZED_KEYS_BACKUP").MustBool(true)
+       SSH.ExposeAnonymous = sec.Key("SSH_EXPOSE_ANONYMOUS").MustBool(false)
 
        if err = Cfg.Section("server").MapTo(&LFS); err != nil {
                log.Fatal(4, "Failed to map LFS settings: %v", err)

diff --git a/templates/repo/bare.tmpl b/templates/repo/bare.tmpl
index b72738fe3484a9e03045d6676fc9ccec650b8c3f..bd37228ad15ef945f8f1664c3348d2a1502d66f3 100644 (file)
--- a/templates/repo/bare.tmpl
+++ b/templates/repo/bare.tmpl
@@ -28,9 +28,11 @@
                                                                {{else}}
                                                                        <input id="repo-clone-url" value="{{$.CloneLink.SSH}}" readonly>
                                                                {{end}}
-                                                               <button class="ui basic button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
-                                                                       <i class="octicon octicon-clippy"></i>
-                                                               </button>
+                                                               {{if not (and $.DisableHTTP $.DisableSSH)}}
+                                                                       <button class="ui basic button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
+                                                                               <i class="octicon octicon-clippy"></i>
+                                                                       </button>
+                                                               {{end}}
                                                        </div>
                                                </div>
                                                <div class="ui divider"></div>

diff --git a/templates/repo/home.tmpl b/templates/repo/home.tmpl
index 664326c56209e6780b440bb7ca01bd1adbf7ef60..5af574ee0490b623ab733e315736ebd113e6c1c9 100644 (file)
--- a/templates/repo/home.tmpl
+++ b/templates/repo/home.tmpl
@@ -56,19 +56,21 @@
                                                                {{if UseHTTPS}}HTTPS{{else}}HTTP{{end}}
                                                        </button>
                                                {{end}}
-                                               {{if not $.DisableSSH}}
+                                               {{if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
                                                        <button class="ui basic clone button" id="repo-clone-ssh" data-link="{{.CloneLink.SSH}}">
                                                                SSH
                                                        </button>
                                                {{end}}
                                                {{if not $.DisableHTTP}}
                                                        <input id="repo-clone-url" value="{{$.CloneLink.HTTPS}}" readonly>
-                                               {{else}}
+                                               {{else if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
                                                        <input id="repo-clone-url" value="{{$.CloneLink.SSH}}" readonly>
                                                {{end}}
-                                               <button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
-                                                       <i class="octicon octicon-clippy"></i>
-                                               </button>
+                                               {{if or ((not $.DisableHTTP) (and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)))}}
+                                                       <button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
+                                                               <i class="octicon octicon-clippy"></i>
+                                                       </button>
+                                               {{end}}
                                                <div class="ui basic jump dropdown icon button poping up" data-content="{{.i18n.Tr "repo.download_archive"}}" data-variation="tiny inverted" data-position="top right">
                                                        <i class="download icon"></i>
                                                        <div class="menu">

diff --git a/templates/repo/wiki/view.tmpl b/templates/repo/wiki/view.tmpl
index b9aa4e9560f3b5c21f211f0ee676f46f3e9098a4..8eab1ac07ba0ae57c045e0257037ad5b9cca3cf8 100644 (file)
--- a/templates/repo/wiki/view.tmpl
+++ b/templates/repo/wiki/view.tmpl
@@ -35,19 +35,21 @@
                                                        {{if UseHTTPS}}HTTPS{{else}}HTTP{{end}}
                                                </button>
                                        {{end}}
-                                       {{if not $.DisableSSH}}
+                                       {{if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
                                                <button class="ui basic clone button" id="repo-clone-ssh" data-link="{{.WikiCloneLink.SSH}}">
                                                        SSH
                                                </button>
                                        {{end}}
                                        {{if not $.DisableHTTP}}
                                                <input id="repo-clone-url" value="{{$.WikiCloneLink.HTTPS}}" readonly>
-                                       {{else}}
+                                       {{else if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
                                                <input id="repo-clone-url" value="{{$.WikiCloneLink.SSH}}" readonly>
                                        {{end}}
-                                       <button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
-                                               <i class="octicon octicon-clippy"></i>
-                                       </button>
+                                       {{if or ((not $.DisableHTTP) (and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)))}}
+                                               <button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
+                                                       <i class="octicon octicon-clippy"></i>
+                                               </button>
+                                       {{end}}
                                </div>
                        </div>
                </div>