Per-repository authorization control: AUTHENTICATED and NAMED (issue 117)

diff --git a/distrib/gitblit.properties b/distrib/gitblit.properties
index 0923c41be42cc4bd7b888d9b42f3a3c1f4109bf8..70718b670744775fcb54573f0ddafb63bb4470a5 100644 (file)
--- a/distrib/gitblit.properties
+++ b/distrib/gitblit.properties
@@ -63,6 +63,14 @@ git.onlyAccessBareRepositories = false
 # SINCE 1.0.0\r
 git.defaultAccessRestriction = NONE\r
 \r
+# The default authorization control for new repositories.\r
+# Valid values are AUTHENTICATED and NAMED\r
+#  AUTHENTICATED = any authenticated user is granted restricted access\r
+#  NAMED = only named users/teams are granted restricted access\r
+#\r
+# SINCE 1.0.1\r
+git.defaultAuthorizationControl = NAMED\r
+\r
 # Number of bytes of a pack file to load into memory in a single read operation.\r
 # This is the "page size" of the JGit buffer cache, used for all pack access\r
 # operations. All disk IO occurs as single window reads. Setting this too large\r

diff --git a/docs/04_releases.mkd b/docs/04_releases.mkd
index e1972109dd166887e63cb26bfa7a4ce26dae5e6d..4e4ee99f91f9d70d708659dd69db1dfc17488aab 100644 (file)
--- a/docs/04_releases.mkd
+++ b/docs/04_releases.mkd
@@ -16,14 +16,22 @@ If you are updating from an 0.9.x release AND you have indexed branches with the
 - Fixed Lucene charset encoding bug when reindexing a repository (issue 112)\r
 - Fixed null pointer in LdapUserSerivce if account has a null email address (issue 110)\r
 \r
-#### changes\r
+#### additions\r
 \r
+- Added a repository setting to control authorization as AUTHENTICATED or NAMED.  \r
+NAMED is the original behavior for authorizing against a list of permitted users or permitted teams.\r
+AUTHENTICATED allows restricted access for any authenticated user.\r
+- Added default authorization control setting (AUTHENTICATED or NAMED)\r
+    **New:** *git.defaultAuthorizationControl=NAMED*  \r
 - Added setting to control how deep Gitblit will recurse into *git.repositoriesFolder* looking for repositories (issue 103)\r
     **New:** *git.searchRecursionDepth=-1*  \r
 - Added setting to specify regex exclusions for repositories (issue 103)\r
     **New:** *git.searchExclusions=*  \r
 - Blob page now supports displaying images (issue 6)\r
 - Non-image binary files can now be downloaded using the RAW link\r
+\r
+#### changes\r
+\r
 - Updated Polish translation\r
 \r
 **1.0.0** *released 2012-07-14*\r

diff --git a/src/com/gitblit/AuthenticationFilter.java b/src/com/gitblit/AuthenticationFilter.java
index 50a67a087a9f9c28d6a04313489ec48f61d13d74..259991c9e4182fd78f3fc544fd2bce7a978a5ec2 100644 (file)
--- a/src/com/gitblit/AuthenticationFilter.java
+++ b/src/com/gitblit/AuthenticationFilter.java
@@ -170,6 +170,7 @@ public abstract class AuthenticationFilter implements Filter {
                public AuthenticatedRequest(HttpServletRequest req) {\r
                        super(req);\r
                        user = new UserModel("anonymous");\r
+                       user.isAuthenticated = false;\r
                }\r
 \r
                UserModel getUser() {\r

diff --git a/src/com/gitblit/Constants.java b/src/com/gitblit/Constants.java
index b80c968c733febec459d7ca28b8b7837c664214f..181fb8f0f02adc4e591ce89ad559f2b9d94a7f9d 100644 (file)
--- a/src/com/gitblit/Constants.java
+++ b/src/com/gitblit/Constants.java
@@ -109,6 +109,28 @@ public class Constants {
                        return name();\r
                }\r
        }\r
+       \r
+       /**\r
+        * Enumeration representing the types of authorization control for an\r
+        * access restricted resource.\r
+        */\r
+       public static enum AuthorizationControl {\r
+               AUTHENTICATED, NAMED;\r
+               \r
+               public static AuthorizationControl fromName(String name) {\r
+                       for (AuthorizationControl type : values()) {\r
+                               if (type.name().equalsIgnoreCase(name)) {\r
+                                       return type;\r
+                               }\r
+                       }\r
+                       return NAMED;\r
+               }\r
+               \r
+               public String toString() {\r
+                       return name();\r
+               }\r
+       }\r
+\r
 \r
        /**\r
         * Enumeration representing the types of federation tokens.\r

diff --git a/src/com/gitblit/GitBlit.java b/src/com/gitblit/GitBlit.java
index 8f51069e656edf771f1ddb28c1097cc1413ac6f4..26f30f915a1047f599daf9997b014e6f3466016a 100644 (file)
--- a/src/com/gitblit/GitBlit.java
+++ b/src/com/gitblit/GitBlit.java
@@ -69,6 +69,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;\r
 \r
 import com.gitblit.Constants.AccessRestrictionType;\r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.Constants.FederationRequest;\r
 import com.gitblit.Constants.FederationStrategy;\r
 import com.gitblit.Constants.FederationToken;\r
@@ -876,6 +877,8 @@ public class GitBlit implements ServletContextListener {
                        model.useDocs = getConfig(config, "useDocs", false);\r
                        model.accessRestriction = AccessRestrictionType.fromName(getConfig(config,\r
                                        "accessRestriction", settings.getString(Keys.git.defaultAccessRestriction, null)));\r
+                       model.authorizationControl = AuthorizationControl.fromName(getConfig(config,\r
+                                       "authorizationControl", settings.getString(Keys.git.defaultAuthorizationControl, null)));\r
                        model.showRemoteBranches = getConfig(config, "showRemoteBranches", false);\r
                        model.isFrozen = getConfig(config, "isFrozen", false);\r
                        model.showReadme = getConfig(config, "showReadme", false);\r
@@ -1135,6 +1138,7 @@ public class GitBlit implements ServletContextListener {
                config.setBoolean(Constants.CONFIG_GITBLIT, null, "useTickets", repository.useTickets);\r
                config.setBoolean(Constants.CONFIG_GITBLIT, null, "useDocs", repository.useDocs);\r
                config.setString(Constants.CONFIG_GITBLIT, null, "accessRestriction", repository.accessRestriction.name());\r
+               config.setString(Constants.CONFIG_GITBLIT, null, "authorizationControl", repository.authorizationControl.name());\r
                config.setBoolean(Constants.CONFIG_GITBLIT, null, "showRemoteBranches", repository.showRemoteBranches);\r
                config.setBoolean(Constants.CONFIG_GITBLIT, null, "isFrozen", repository.isFrozen);\r
                config.setBoolean(Constants.CONFIG_GITBLIT, null, "showReadme", repository.showReadme);\r

diff --git a/src/com/gitblit/GitServlet.java b/src/com/gitblit/GitServlet.java
index 68097cb8ae1a0d32a9455ff18e425255470351a8..0b5575bc909085178c85da49138848ebd11db2ed 100644 (file)
--- a/src/com/gitblit/GitServlet.java
+++ b/src/com/gitblit/GitServlet.java
@@ -231,6 +231,7 @@ public class GitServlet extends org.eclipse.jgit.http.server.GitServlet {
                        if (user == null) {\r
                                // anonymous push, create a temporary usermodel\r
                                user = new UserModel(person.getName());\r
+                               user.isAuthenticated = false;\r
                        }\r
                        return user;\r
                }\r

diff --git a/src/com/gitblit/client/EditRepositoryDialog.java b/src/com/gitblit/client/EditRepositoryDialog.java
index 77878cbb14dc27fe77016f9e4411a9ea9c065021..8ce076ec056f35e50a4438a21816c6249b4e7c71 100644 (file)
--- a/src/com/gitblit/client/EditRepositoryDialog.java
+++ b/src/com/gitblit/client/EditRepositoryDialog.java
@@ -35,6 +35,7 @@ import java.util.Map;
 import java.util.Set;\r
 \r
 import javax.swing.BoxLayout;\r
+import javax.swing.ButtonGroup;\r
 import javax.swing.DefaultComboBoxModel;\r
 import javax.swing.ImageIcon;\r
 import javax.swing.JButton;\r
@@ -46,6 +47,7 @@ import javax.swing.JLabel;
 import javax.swing.JList;\r
 import javax.swing.JOptionPane;\r
 import javax.swing.JPanel;\r
+import javax.swing.JRadioButton;\r
 import javax.swing.JRootPane;\r
 import javax.swing.JScrollPane;\r
 import javax.swing.JTabbedPane;\r
@@ -55,6 +57,7 @@ import javax.swing.ListCellRenderer;
 import javax.swing.ScrollPaneConstants;\r
 \r
 import com.gitblit.Constants.AccessRestrictionType;\r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.Constants.FederationStrategy;\r
 import com.gitblit.models.RepositoryModel;\r
 import com.gitblit.utils.ArrayUtils;\r
@@ -98,6 +101,10 @@ public class EditRepositoryDialog extends JDialog {
        private JTextField mailingListsField;\r
 \r
        private JComboBox accessRestriction;\r
+       \r
+       private JRadioButton allowAuthenticated;\r
+       \r
+       private JRadioButton allowNamed;\r
 \r
        private JComboBox federationStrategy;\r
 \r
@@ -206,6 +213,21 @@ public class EditRepositoryDialog extends JDialog {
                accessRestriction = new JComboBox(AccessRestrictionType.values());\r
                accessRestriction.setRenderer(new AccessRestrictionRenderer());\r
                accessRestriction.setSelectedItem(anRepository.accessRestriction);\r
+               \r
+               boolean authenticated = anRepository.authorizationControl != null \r
+                               && AuthorizationControl.AUTHENTICATED.equals(anRepository.authorizationControl);\r
+               allowAuthenticated = new JRadioButton(Translation.get("gb.allowAuthenticatedDescription"));\r
+               allowAuthenticated.setSelected(authenticated);\r
+               allowNamed = new JRadioButton(Translation.get("gb.allowNamedDescription"));\r
+               allowNamed.setSelected(!authenticated);\r
+               \r
+               ButtonGroup group = new ButtonGroup();\r
+               group.add(allowAuthenticated);\r
+               group.add(allowNamed);\r
+               \r
+               JPanel authorizationPanel = new JPanel(new GridLayout(0, 1));\r
+               authorizationPanel.add(allowAuthenticated);\r
+               authorizationPanel.add(allowNamed);\r
 \r
                // federation strategies - remove ORIGIN choice if this repository has\r
                // no origin.\r
@@ -246,12 +268,15 @@ public class EditRepositoryDialog extends JDialog {
                                mailingListsField));\r
 \r
                usersPalette = new JPalette<String>();\r
+               JPanel northAccessPanel = new JPanel(new BorderLayout(5, 5));\r
+               northAccessPanel.add(newFieldPanel(Translation.get("gb.accessRestriction"),\r
+                               accessRestriction), BorderLayout.NORTH);\r
+               northAccessPanel.add(newFieldPanel(Translation.get("gb.authorizationControl"),\r
+                               authorizationPanel), BorderLayout.CENTER);\r
+\r
                JPanel accessPanel = new JPanel(new BorderLayout(5, 5));\r
-               accessPanel.add(\r
-                               newFieldPanel(Translation.get("gb.accessRestriction"),\r
-                                               accessRestriction), BorderLayout.NORTH);\r
-               accessPanel.add(\r
-                               newFieldPanel(Translation.get("gb.permittedUsers"),\r
+               accessPanel.add(northAccessPanel, BorderLayout.NORTH);\r
+               accessPanel.add(newFieldPanel(Translation.get("gb.permittedUsers"),\r
                                                usersPalette), BorderLayout.CENTER);\r
 \r
                teamsPalette = new JPalette<String>();\r
@@ -463,6 +488,8 @@ public class EditRepositoryDialog extends JDialog {
 \r
                repository.accessRestriction = (AccessRestrictionType) accessRestriction\r
                                .getSelectedItem();\r
+               repository.authorizationControl = allowAuthenticated.isSelected() ? \r
+                               AuthorizationControl.AUTHENTICATED : AuthorizationControl.NAMED;\r
                repository.federationStrategy = (FederationStrategy) federationStrategy\r
                                .getSelectedItem();\r
 \r
@@ -495,6 +522,12 @@ public class EditRepositoryDialog extends JDialog {
                this.accessRestriction.setSelectedItem(restriction);\r
        }\r
 \r
+       public void setAuthorizationControl(AuthorizationControl authorization) {\r
+               boolean authenticated = authorization != null && AuthorizationControl.AUTHENTICATED.equals(authorization);\r
+               this.allowAuthenticated.setSelected(authenticated);\r
+               this.allowNamed.setSelected(!authenticated);\r
+       }\r
+\r
        public void setUsers(String owner, List<String> all, List<String> selected) {\r
                ownerField.setModel(new DefaultComboBoxModel(all.toArray()));\r
                if (!StringUtils.isEmpty(owner)) {\r

diff --git a/src/com/gitblit/client/GitblitClient.java b/src/com/gitblit/client/GitblitClient.java
index ed5a1337744115ee4b89dcbb43d5a4998d7739dd..5e05fa49b90df8fe46d6ad530177ac9ef20a23fc 100644 (file)
--- a/src/com/gitblit/client/GitblitClient.java
+++ b/src/com/gitblit/client/GitblitClient.java
@@ -29,6 +29,7 @@ import java.util.TreeSet;
 \r
 import com.gitblit.Constants;\r
 import com.gitblit.Constants.AccessRestrictionType;\r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.GitBlitException.ForbiddenException;\r
 import com.gitblit.GitBlitException.NotAllowedException;\r
 import com.gitblit.GitBlitException.UnauthorizedException;\r
@@ -195,6 +196,14 @@ public class GitblitClient implements Serializable {
                return AccessRestrictionType.fromName(restriction);\r
        }\r
 \r
+       public AuthorizationControl getDefaultAuthorizationControl() {\r
+               String authorization = null;\r
+               if (settings.hasKey(Keys.git.defaultAuthorizationControl)) {\r
+                       authorization = settings.get(Keys.git.defaultAuthorizationControl).currentValue;\r
+               }\r
+               return AuthorizationControl.fromName(authorization);\r
+       }\r
+\r
        /**\r
         * Returns the list of pre-receive scripts the repository inherited from the\r
         * global settings and team affiliations.\r

diff --git a/src/com/gitblit/client/RepositoriesPanel.java b/src/com/gitblit/client/RepositoriesPanel.java
index 70b87c6ce21431e3c5bb8639616cacac994ef15e..cbe187432c9e083e7bce788f87a899d4d64831e1 100644 (file)
--- a/src/com/gitblit/client/RepositoriesPanel.java
+++ b/src/com/gitblit/client/RepositoriesPanel.java
@@ -358,6 +358,7 @@ public abstract class RepositoriesPanel extends JPanel {
                EditRepositoryDialog dialog = new EditRepositoryDialog(gitblit.getProtocolVersion());\r
                dialog.setLocationRelativeTo(RepositoriesPanel.this);\r
                dialog.setAccessRestriction(gitblit.getDefaultAccessRestriction());\r
+               dialog.setAuthorizationControl(gitblit.getDefaultAuthorizationControl());\r
                dialog.setUsers(null, gitblit.getUsernames(), null);\r
                dialog.setTeams(gitblit.getTeamnames(), null);\r
                dialog.setRepositories(gitblit.getRepositories());\r

diff --git a/src/com/gitblit/models/RepositoryModel.java b/src/com/gitblit/models/RepositoryModel.java
index 0e0c2df1e7e209293c797a5366744833d6d7647f..27196635dde03df14262687d64f3f1941f33b13d 100644 (file)
--- a/src/com/gitblit/models/RepositoryModel.java
+++ b/src/com/gitblit/models/RepositoryModel.java
@@ -22,6 +22,7 @@ import java.util.List;
 import java.util.Map;\r
 \r
 import com.gitblit.Constants.AccessRestrictionType;\r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.Constants.FederationStrategy;\r
 import com.gitblit.utils.ArrayUtils;\r
 import com.gitblit.utils.StringUtils;\r
@@ -47,6 +48,8 @@ public class RepositoryModel implements Serializable, Comparable<RepositoryModel
        public boolean useTickets;\r
        public boolean useDocs;\r
        public AccessRestrictionType accessRestriction;\r
+       public AuthorizationControl authorizationControl;\r
+       public boolean allowAuthenticated;\r
        public boolean isFrozen;\r
        public boolean showReadme;\r
        public FederationStrategy federationStrategy;\r
@@ -77,6 +80,7 @@ public class RepositoryModel implements Serializable, Comparable<RepositoryModel
                this.owner = owner;\r
                this.lastChange = lastchange;\r
                this.accessRestriction = AccessRestrictionType.NONE;\r
+               this.authorizationControl = AuthorizationControl.NAMED;\r
                this.federationSets = new ArrayList<String>();\r
                this.federationStrategy = FederationStrategy.FEDERATE_THIS;             \r
        }\r

diff --git a/src/com/gitblit/models/UserModel.java b/src/com/gitblit/models/UserModel.java
index 6632c611316c02596fd37e84d82e916e64ef25b6..8349bab6f8290e7279680474059ac83aff56fb8d 100644 (file)
--- a/src/com/gitblit/models/UserModel.java
+++ b/src/com/gitblit/models/UserModel.java
@@ -20,6 +20,7 @@ import java.security.Principal;
 import java.util.HashSet;\r
 import java.util.Set;\r
 \r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.utils.StringUtils;\r
 \r
 /**\r
@@ -45,8 +46,12 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel>
        public final Set<String> repositories = new HashSet<String>();\r
        public final Set<TeamModel> teams = new HashSet<TeamModel>();\r
 \r
+       // non-persisted fields\r
+       public boolean isAuthenticated;\r
+       \r
        public UserModel(String username) {\r
                this.username = username;\r
+               this.isAuthenticated = true;\r
        }\r
 \r
        /**\r
@@ -65,8 +70,9 @@ public class UserModel implements Principal, Serializable, Comparable<UserModel>
        public boolean canAccessRepository(RepositoryModel repository) {\r
                boolean isOwner = !StringUtils.isEmpty(repository.owner)\r
                                && repository.owner.equals(username);\r
+               boolean allowAuthenticated = isAuthenticated && AuthorizationControl.AUTHENTICATED.equals(repository.authorizationControl);\r
                return canAdmin || isOwner || repositories.contains(repository.name.toLowerCase())\r
-                               || hasTeamAccess(repository.name);\r
+                               || hasTeamAccess(repository.name) || allowAuthenticated;\r
        }\r
 \r
        public boolean hasTeamAccess(String repositoryName) {\r

diff --git a/src/com/gitblit/wicket/GitBlitWebApp.properties b/src/com/gitblit/wicket/GitBlitWebApp.properties
index f8a936de8465248c1f7db87e93eb90c44f4effb9..bcd63370fcaf6cd13a6b21d2412fca7205df6afd 100644 (file)
--- a/src/com/gitblit/wicket/GitBlitWebApp.properties
+++ b/src/com/gitblit/wicket/GitBlitWebApp.properties
@@ -310,3 +310,6 @@ gb.duration.oneMonth = 1 month
 gb.duration.months = {0} months\r
 gb.duration.oneYear = 1 year\r
 gb.duration.years = {0} years\r
+gb.authorizationControl = authorization control\r
+gb.allowAuthenticatedDescription = grant restricted access to all authenticated users\r
+gb.allowNamedDescription = grant restricted access to named users or teams
\ No newline at end of file

diff --git a/src/com/gitblit/wicket/pages/EditRepositoryPage.html b/src/com/gitblit/wicket/pages/EditRepositoryPage.html
index a419698d941a969b2461402660db4cf46977e7b9..2bb5776c78cc6dbb6cd5ffb443cf65ebda0b183e 100644 (file)
--- a/src/com/gitblit/wicket/pages/EditRepositoryPage.html
+++ b/src/com/gitblit/wicket/pages/EditRepositoryPage.html
@@ -25,11 +25,19 @@
                                <tr><th><wicket:message key="gb.isFrozen"></wicket:message></th><td class="edit"><label class="checkbox"><input type="checkbox" wicket:id="isFrozen" tabindex="12" /> &nbsp;<span class="help-inline"><wicket:message key="gb.isFrozenDescription"></wicket:message></span></label></td></tr>\r
                                <tr><th><wicket:message key="gb.mailingLists"></wicket:message></th><td class="edit"><input class="span8" type="text" wicket:id="mailingLists" size="40" tabindex="13" /></td></tr>\r
                                <tr><td colspan="2" style="padding-top:15px"><h3><wicket:message key="gb.accessPermissions"></wicket:message> &nbsp;<small><wicket:message key="gb.accessPermissionsDescription"></wicket:message></small></h3></td></tr>       \r
-                               <tr><th><wicket:message key="gb.accessRestriction"></wicket:message></th><td class="edit"><select class="span4" wicket:id="accessRestriction" tabindex="14" /></td></tr>                                \r
+                               <tr><th><wicket:message key="gb.accessRestriction"></wicket:message></th><td class="edit"><select class="span4" wicket:id="accessRestriction" tabindex="14" /></td></tr>\r
+                               <tr><th colspan="2"><hr/></th></tr>\r
+                               <tr><th style="vertical-align: top;"><wicket:message key="gb.authorizationControl"></wicket:message></th><td style="padding:2px;">\r
+                                       <wicket:container wicket:id="authorizationControl">\r
+                                               <label class="radio"><input type="radio" wicket:id="allowAuthenticated" tabindex="15" /> &nbsp;<span class="help-inline"><wicket:message key="gb.allowAuthenticatedDescription"></wicket:message></span></label>\r
+                                               <label class="radio"><input type="radio" wicket:id="allowNamed" tabindex="16" /> &nbsp;<span class="help-inline"><wicket:message key="gb.allowNamedDescription"></wicket:message></span></label>\r
+                                       </wicket:container>\r
+                               </td></tr>\r
+                               <tr><th colspan="2"><hr/></th></tr>\r
                                <tr><th style="vertical-align: top;"><wicket:message key="gb.permittedUsers"></wicket:message></th><td style="padding:2px;"><span wicket:id="users"></span></td></tr>\r
                                <tr><th style="vertical-align: top;"><wicket:message key="gb.permittedTeams"></wicket:message></th><td style="padding:2px;"><span wicket:id="teams"></span></td></tr>\r
                                <tr><td colspan="2"><h3><wicket:message key="gb.federation"></wicket:message> &nbsp;<small><wicket:message key="gb.federationRepositoryDescription"></wicket:message></small></h3></td></tr>    \r
-                               <tr><th><wicket:message key="gb.federationStrategy"></wicket:message></th><td class="edit"><select class="span4" wicket:id="federationStrategy" tabindex="15" /></td></tr>\r
+                               <tr><th><wicket:message key="gb.federationStrategy"></wicket:message></th><td class="edit"><select class="span4" wicket:id="federationStrategy" tabindex="17" /></td></tr>\r
                                <tr><th style="vertical-align: top;"><wicket:message key="gb.federationSets"></wicket:message></th><td style="padding:2px;"><span wicket:id="federationSets"></span></td></tr>\r
                                <tr><td colspan="2"><h3><wicket:message key="gb.search"></wicket:message> &nbsp;<small><wicket:message key="gb.indexedBranchesDescription"></wicket:message></small></h3></td></tr>     \r
                                <tr><th style="vertical-align: top;"><wicket:message key="gb.indexedBranches"></wicket:message></th><td style="padding:2px;"><span wicket:id="indexedBranches"></span></td></tr>\r

diff --git a/src/com/gitblit/wicket/pages/EditRepositoryPage.java b/src/com/gitblit/wicket/pages/EditRepositoryPage.java
index 0176249bbf0c60086008d6d40293b1d4098dbb82..505cb5486d8be1e5d6ad9c3734645e65487d4829 100644 (file)
--- a/src/com/gitblit/wicket/pages/EditRepositoryPage.java
+++ b/src/com/gitblit/wicket/pages/EditRepositoryPage.java
@@ -36,6 +36,8 @@ import org.apache.wicket.markup.html.form.CheckBox;
 import org.apache.wicket.markup.html.form.DropDownChoice;\r
 import org.apache.wicket.markup.html.form.Form;\r
 import org.apache.wicket.markup.html.form.IChoiceRenderer;\r
+import org.apache.wicket.markup.html.form.Radio;\r
+import org.apache.wicket.markup.html.form.RadioGroup;\r
 import org.apache.wicket.markup.html.form.TextField;\r
 import org.apache.wicket.markup.html.list.ListItem;\r
 import org.apache.wicket.markup.html.list.ListView;\r
@@ -47,6 +49,7 @@ import org.apache.wicket.model.util.ListModel;
 \r
 import com.gitblit.Constants;\r
 import com.gitblit.Constants.AccessRestrictionType;\r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.Constants.FederationStrategy;\r
 import com.gitblit.GitBlit;\r
 import com.gitblit.GitBlitException;\r
@@ -75,6 +78,8 @@ public class EditRepositoryPage extends RootSubPage {
                RepositoryModel model = new RepositoryModel();\r
                String restriction = GitBlit.getString(Keys.git.defaultAccessRestriction, null);\r
                model.accessRestriction = AccessRestrictionType.fromName(restriction);\r
+               String authorization = GitBlit.getString(Keys.git.defaultAuthorizationControl, null);\r
+               model.authorizationControl = AuthorizationControl.fromName(authorization);\r
                setupPage(model);\r
        }\r
 \r
@@ -370,6 +375,14 @@ public class EditRepositoryPage extends RootSubPage {
                                : StringUtils.flattenStrings(repositoryModel.mailingLists, " "));\r
                form.add(new TextField<String>("mailingLists", mailingLists));\r
                form.add(indexedBranchesPalette);\r
+               \r
+               RadioGroup<AuthorizationControl> group = new RadioGroup<AuthorizationControl>("authorizationControl");\r
+               Radio<AuthorizationControl> allowAuthenticated = new Radio<AuthorizationControl>("allowAuthenticated", new Model<AuthorizationControl>(AuthorizationControl.AUTHENTICATED));            \r
+               Radio<AuthorizationControl> allowNamed = new Radio<AuthorizationControl>("allowNamed", new Model<AuthorizationControl>(AuthorizationControl.NAMED));\r
+               group.add(allowAuthenticated);\r
+               group.add(allowNamed);\r
+               form.add(group);\r
+                               \r
                form.add(usersPalette);\r
                form.add(teamsPalette);\r
                form.add(federationSetsPalette);\r

diff --git a/tests/com/gitblit/tests/GitServletTest.java b/tests/com/gitblit/tests/GitServletTest.java
index 848a1d051829bf9cf5688ac1254e22c5b2ebe23b..bdbb2a5a04c50fcc2ebef0ce17fd522986f5a93e 100644 (file)
--- a/tests/com/gitblit/tests/GitServletTest.java
+++ b/tests/com/gitblit/tests/GitServletTest.java
@@ -21,8 +21,10 @@ import org.junit.BeforeClass;
 import org.junit.Test;\r
 \r
 import com.gitblit.Constants.AccessRestrictionType;\r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.GitBlit;\r
 import com.gitblit.models.RepositoryModel;\r
+import com.gitblit.models.UserModel;\r
 \r
 public class GitServletTest {\r
 \r
@@ -108,6 +110,64 @@ public class GitServletTest {
 \r
                assertFalse("Bogus login cloned a repository?!", cloned);\r
        }\r
+       \r
+       @Test\r
+       public void testUnauthorizedLoginClone() throws Exception {\r
+               // restrict repository access\r
+               RepositoryModel model = GitBlit.self().getRepositoryModel("ticgit.git");\r
+               model.accessRestriction = AccessRestrictionType.CLONE;\r
+               model.authorizationControl = AuthorizationControl.NAMED;\r
+               UserModel user = new UserModel("james");\r
+               user.password = "james";\r
+               GitBlit.self().updateUserModel(user.username, user, true);\r
+               GitBlit.self().updateRepositoryModel(model.name, model, false);\r
+\r
+               FileUtils.delete(ticgit2Folder, FileUtils.RECURSIVE);\r
+               \r
+               // delete any existing working folder           \r
+               boolean cloned = false;\r
+               try {\r
+                       CloneCommand clone = Git.cloneRepository();\r
+                       clone.setURI(MessageFormat.format("{0}/git/ticgit.git", url));\r
+                       clone.setDirectory(ticgit2Folder);\r
+                       clone.setBare(false);\r
+                       clone.setCloneAllBranches(true);\r
+                       clone.setCredentialsProvider(new UsernamePasswordCredentialsProvider(user.username, user.password));\r
+                       close(clone.call());\r
+                       cloned = true;\r
+               } catch (Exception e) {\r
+                       // swallow the exception which we expect\r
+               }\r
+\r
+               assertFalse("Unauthorized login cloned a repository?!", cloned);\r
+\r
+               FileUtils.delete(ticgit2Folder, FileUtils.RECURSIVE);\r
+               \r
+               // switch to authenticated\r
+               model.authorizationControl = AuthorizationControl.AUTHENTICATED;\r
+               GitBlit.self().updateRepositoryModel(model.name, model, false);\r
+               \r
+               // try clone again\r
+               cloned = false;\r
+               CloneCommand clone = Git.cloneRepository();\r
+               clone.setURI(MessageFormat.format("{0}/git/ticgit.git", url));\r
+               clone.setDirectory(ticgit2Folder);\r
+               clone.setBare(false);\r
+               clone.setCloneAllBranches(true);\r
+               clone.setCredentialsProvider(new UsernamePasswordCredentialsProvider(user.username, user.password));\r
+               close(clone.call());\r
+               cloned = true;\r
+\r
+               assertTrue("Authenticated login could not clone!", cloned);\r
+               \r
+               FileUtils.delete(ticgit2Folder, FileUtils.RECURSIVE);\r
+               \r
+               // restore anonymous repository access\r
+               model.accessRestriction = AccessRestrictionType.NONE;\r
+               model.authorizationControl = AuthorizationControl.NAMED;\r
+               GitBlit.self().updateRepositoryModel(model.name, model, false);\r
+               GitBlit.self().deleteUser(user.username);\r
+       }\r
 \r
        @Test\r
        public void testAnonymousPush() throws Exception {\r

diff --git a/tests/com/gitblit/tests/RpcTests.java b/tests/com/gitblit/tests/RpcTests.java
index f85dd79a772568fab4b15212cf4afca8767e7989..1080849ce85b90c55e94a017a909553da610f9c7 100644 (file)
--- a/tests/com/gitblit/tests/RpcTests.java
+++ b/tests/com/gitblit/tests/RpcTests.java
@@ -33,6 +33,7 @@ import org.junit.BeforeClass;
 import org.junit.Test;\r
 \r
 import com.gitblit.Constants.AccessRestrictionType;\r
+import com.gitblit.Constants.AuthorizationControl;\r
 import com.gitblit.GitBlitException.UnauthorizedException;\r
 import com.gitblit.Keys;\r
 import com.gitblit.RpcServlet;\r
@@ -164,6 +165,7 @@ public class RpcTests {
                model.description = "created by RpcUtils";\r
                model.owner = "garbage";\r
                model.accessRestriction = AccessRestrictionType.VIEW;\r
+               model.authorizationControl = AuthorizationControl.AUTHENTICATED;\r
 \r
                // create\r
                assertTrue("Failed to create repository!",\r
@@ -172,6 +174,7 @@ public class RpcTests {
                RepositoryModel retrievedRepository = findRepository(model.name);\r
                assertNotNull("Failed to find " + model.name, retrievedRepository);\r
                assertEquals(AccessRestrictionType.VIEW, retrievedRepository.accessRestriction);\r
+               assertEquals(AuthorizationControl.AUTHENTICATED, retrievedRepository.authorizationControl);\r
 \r
                // rename and change access restriciton\r
                String originalName = model.name;\r