Fixed security hole when cloning repository with TortoiseGit (issue 28)

diff --git a/docs/00_index.mkd b/docs/00_index.mkd
index 8627269097a7a831ed87d68192a9f8374b08a007..12edae5dfa638ef565c497fdeed08f932c5e94ca 100644 (file)
--- a/docs/00_index.mkd
+++ b/docs/00_index.mkd
@@ -29,6 +29,7 @@ Gitblit requires a Java 6 Runtime Environment (JRE) or a Java 6 Development Kit
 \r
 **%VERSION%** ([go](http://code.google.com/p/gitblit/downloads/detail?name=%GO%)|[war](http://code.google.com/p/gitblit/downloads/detail?name=%WAR%)|[fedclient](http://code.google.com/p/gitblit/downloads/detail?name=%FEDCLIENT%)|[manager](http://code.google.com/p/gitblit/downloads/detail?name=%MANAGER%)) based on [%JGIT%][jgit]   *released %BUILDDATE%*\r
 \r
+- **security**: fixed security hole when cloning clone-restricted repository with TortoiseGit (issue 28)\r
 - improved: updated ui with Twitter's Bootstrap CSS toolkit  \r
     **New:** *web.loginMessage = gitblit*\r
 - improved: repositories list performance by caching repository sizes (issue 27)\r
@@ -45,7 +46,7 @@ Gitblit requires a Java 6 Runtime Environment (JRE) or a Java 6 Development Kit
 - fixed: collision on rename for repositories and users\r
 - fixed: Gitblit can now browse the Linux kernel repository (issue 25)\r
 - fixed: Gitblit now runs on Servlet 3.0 webservers (e.g. Tomcat 7, Jetty 8) (issue 23)\r
-- fixed: Set the RSS content type for Firefox 4 (issue 22)\r
+- fixed: Set the RSS content type of syndication feeds for Firefox 4 (issue 22)\r
 - fixed: Null pointer exception if did not set federation strategy (issue 20)\r
 - fixed: Gitblit GO allows SSL renegotiation if running on Java 1.6.0_22 or later\r
 - added: IUserService.setup(IStoredSettings) for custom user service implementations\r

diff --git a/docs/01_features.mkd b/docs/01_features.mkd
index 93647101568181de97e0e72b99f0c0d7865a4744..5f15aaeac1ec70745f5641106a5875c8725f3e16 100644 (file)
--- a/docs/01_features.mkd
+++ b/docs/01_features.mkd
@@ -9,11 +9,12 @@
     - ![freeze](cold_16x16.png) Freeze repository (i.e. deny push, make read-only)\r
 - Ability to federate with one or more other Gitblit instances\r
 - JSON RPC interface\r
+- Java/Swing Gitblit Manager tool \r
 - Gitweb inspired web UI\r
-- Administrators may create, edit, rename, or delete repositories through the web UI\r
-- Administrators may create, edit, rename, or delete users through the web UI\r
+- Administrators may create, edit, rename, or delete repositories through the web UI or RPC interface\r
+- Administrators may create, edit, rename, or delete users through the web UI or RPC interface\r
 - Repository Owners may edit repositories through the web UI\r
-- Git-notes support\r
+- Git-notes display support\r
 - Branch metrics (uses Google Charts)\r
 - HEAD and Branch RSS feeds\r
 - Blame annotations view\r

diff --git a/docs/02_rpc.mkd b/docs/02_rpc.mkd
index 94739ca36356a3089b6a3a525cf42147e0715a3d..0150d16877119ba74b853ce86e85c8db39fd3b07 100644 (file)
--- a/docs/02_rpc.mkd
+++ b/docs/02_rpc.mkd
@@ -84,6 +84,7 @@ Currently this project is in the planning stage.
     ],\r
     "isFederated": false,\r
     "skipSizeCalculation": false,\r
+    "skipSummaryMetrics": false,\r
     "size": "102 KB"\r
   },\r
   "https://localhost/git/libraries/smack.git": {\r
@@ -102,6 +103,7 @@ Currently this project is in the planning stage.
     "federationSets": [],\r
     "isFederated": false,\r
     "skipSizeCalculation": false,\r
+    "skipSummaryMetrics": false,\r
     "size": "4.8 MB"\r
   }\r
 }\r
@@ -131,6 +133,8 @@ The original repository name is specified in the *name* url parameter.  The new
       "libraries"\r
     ],\r
     "isFederated": false,\r
+    "skipSizeCalculation": false,\r
+    "skipSummaryMetrics": false,\r
     "size": "102 KB"\r
 }\r
 </pre>\r

diff --git a/docs/04_releases.mkd b/docs/04_releases.mkd
index e844322bbe412a66ecf812a3456679b6e60c0bb2..68e09084d29d340021469aab81682d4af43eb861 100644 (file)
--- a/docs/04_releases.mkd
+++ b/docs/04_releases.mkd
@@ -3,6 +3,7 @@
 ### Current Release\r
 **%VERSION%** ([go](http://code.google.com/p/gitblit/downloads/detail?name=%GO%)|[war](http://code.google.com/p/gitblit/downloads/detail?name=%WAR%)|[fedclient](http://code.google.com/p/gitblit/downloads/detail?name=%FEDCLIENT%)|[manager](http://code.google.com/p/gitblit/downloads/detail?name=%MANAGER%)) based on [%JGIT%][jgit]   *released %BUILDDATE%*\r
 \r
+- **security**: fixed security hole when cloning clone-restricted repository with TortoiseGit (issue 28)\r
 - improved: updated ui with Twitter's Bootstrap CSS toolkit  \r
     **New:** *web.loginMessage = gitblit*\r
 - improved: repositories list performance by caching repository sizes (issue 27)\r
@@ -19,7 +20,7 @@
 - fixed: collision on rename for repositories and users\r
 - fixed: Gitblit can now browse the Linux kernel repository (issue 25)\r
 - fixed: Gitblit now runs on Servlet 3.0 webservers (e.g. Tomcat 7, Jetty 8) (issue 23)\r
-- fixed: Set the RSS content type for Firefox 4 (issue 22)\r
+- fixed: Set the RSS content type of syndication feeds for Firefox 4 (issue 22)\r
 - fixed: Null pointer exception if did not set federation strategy (issue 20)\r
 - fixed: Gitblit GO allows SSL renegotiation if running on Java 1.6.0_22 or later\r
 - added: IUserService.setup(IStoredSettings) for custom user service implementations\r

diff --git a/src/com/gitblit/AccessRestrictionFilter.java b/src/com/gitblit/AccessRestrictionFilter.java
index 27e2a18a7099661f21cced268bc8a91a061055c3..a8d50b8c8fc9bf362c804e573d9731d4eb5d9158 100644 (file)
--- a/src/com/gitblit/AccessRestrictionFilter.java
+++ b/src/com/gitblit/AccessRestrictionFilter.java
@@ -25,7 +25,6 @@ import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;\r
 import javax.servlet.http.HttpServletResponse;\r
 \r
-import com.gitblit.AuthenticationFilter.AuthenticatedRequest;\r
 import com.gitblit.models.RepositoryModel;\r
 import com.gitblit.models.UserModel;\r
 import com.gitblit.utils.StringUtils;\r

diff --git a/src/com/gitblit/GitFilter.java b/src/com/gitblit/GitFilter.java
index 83e7ac830f3265ad98e4bebeb1537c7a6cb71064..8127ffae974a1c1b7e757c712d9db7312a5712c5 100644 (file)
--- a/src/com/gitblit/GitFilter.java
+++ b/src/com/gitblit/GitFilter.java
@@ -75,6 +75,8 @@ public class GitFilter extends AccessRestrictionFilter {
                                return gitReceivePack;\r
                        } else if (suffix.contains("?service=git-upload-pack")) {\r
                                return gitUploadPack;\r
+                       } else {\r
+                               return gitUploadPack;\r
                        }\r
                }\r
                return null;\r

diff --git a/tests/com/gitblit/tests/GitServletTest.java b/tests/com/gitblit/tests/GitServletTest.java
index 0ede7cab63b4af048c271cf810a94aa7e6d9ca1c..6a839742741efea0c0d69ccb594a1b92a1b743ed 100644 (file)
--- a/tests/com/gitblit/tests/GitServletTest.java
+++ b/tests/com/gitblit/tests/GitServletTest.java
@@ -12,6 +12,7 @@ import junit.framework.TestCase;
 \r
 import org.eclipse.jgit.api.CloneCommand;\r
 import org.eclipse.jgit.api.Git;\r
+import org.eclipse.jgit.transport.UsernamePasswordCredentialsProvider;\r
 import org.eclipse.jgit.util.FileUtils;\r
 \r
 import com.gitblit.GitBlitServer;\r
@@ -50,7 +51,9 @@ public class GitServletTest extends TestCase {
        }\r
 \r
        public void testClone() throws Exception {\r
-               FileUtils.delete(folder, FileUtils.RECURSIVE);\r
+               if (folder.exists()) {\r
+                       FileUtils.delete(folder, FileUtils.RECURSIVE);\r
+               }\r
                CloneCommand clone = Git.cloneRepository();\r
                clone.setURI(MessageFormat.format("http://localhost:{0,number,#}/git/ticgit.git", port));\r
                clone.setDirectory(folder);\r
@@ -71,4 +74,18 @@ public class GitServletTest extends TestCase {
                git.push().setPushAll().call();\r
                git.getRepository().close();\r
        }\r
+               \r
+       public void testBogusLoginClone() throws Exception {\r
+               File folder = new File(GitBlitSuite.REPOSITORIES, "working/gitblit");\r
+               if (folder.exists()) {\r
+                       FileUtils.delete(folder, FileUtils.RECURSIVE);\r
+               }\r
+               CloneCommand clone = Git.cloneRepository();\r
+               clone.setURI(MessageFormat.format("http://localhost:{0,number,#}/git/gitblit.git", port));\r
+               clone.setDirectory(folder);\r
+               clone.setBare(false);\r
+               clone.setCloneAllBranches(true);\r
+               clone.setCredentialsProvider(new UsernamePasswordCredentialsProvider("bogus", "bogus"));\r
+               clone.call();\r
+       }\r
 }\r