Exclude SSH repository urls from anonymous users

diff --git a/src/main/java/com/gitblit/manager/ServicesManager.java b/src/main/java/com/gitblit/manager/ServicesManager.java
index 17724f2b9a01a83b192af2746cfc0cab233578ff..93121cfb271b4eeb0fee9737958fd653d5081387 100644 (file)
--- a/src/main/java/com/gitblit/manager/ServicesManager.java
+++ b/src/main/java/com/gitblit/manager/ServicesManager.java
@@ -228,6 +228,10 @@ public class ServicesManager implements IManager {
        }
 
        public String getSshDaemonUrl(HttpServletRequest request, UserModel user, RepositoryModel repository) {
+               if (user == null || UserModel.ANONYMOUS.equals(user)) {
+                       // SSH always requires authentication - anonymous access prohibited
+                       return null;
+               }
                if (sshDaemon != null) {
                        String bindInterface = settings.getString(Keys.git.sshBindInterface, "localhost");
                        if (bindInterface.equals("localhost")