From 0e6b9ea786a77a4df4aa9fff1b96b9483bcdded5 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Thu, 23 Feb 2017 11:40:44 +0800 Subject: Take back control of hooks (#1006) * git: delegate all server-side Git hooks (#1623) * create hooks directories * take control hooks back * fix lint * bug fixed and minor changes * fix imports style * fix migration scripts --- cmd/hook.go | 106 ++++++++++ cmd/serv.go | 373 ++++++++++++++++++++++++++++++++ cmd/serve.go | 375 --------------------------------- main.go | 2 +- models/migrations/migrations.go | 2 + models/migrations/v18.go | 4 +- models/migrations/v19.go | 85 ++++++++ models/repo.go | 75 +++++-- models/wiki.go | 4 +- options/locale/locale_en-US.ini | 4 +- routers/admin/admin.go | 4 +- templates/admin/dashboard.tmpl | 2 +- vendor/code.gitea.io/git/hook.go | 10 +- vendor/code.gitea.io/git/repo_blame.go | 10 + vendor/vendor.json | 6 +- 15 files changed, 650 insertions(+), 412 deletions(-) create mode 100644 cmd/hook.go create mode 100644 cmd/serv.go delete mode 100644 cmd/serve.go create mode 100644 models/migrations/v19.go create mode 100644 vendor/code.gitea.io/git/repo_blame.go diff --git a/cmd/hook.go b/cmd/hook.go new file mode 100644 index 0000000000..15ad74f8e0 --- /dev/null +++ b/cmd/hook.go @@ -0,0 +1,106 @@ +// Copyright 2017 The Gitea Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package cmd + +import ( + "fmt" + "os" + + "code.gitea.io/gitea/models" + + "github.com/urfave/cli" +) + +var ( + // CmdHook represents the available hooks sub-command. + CmdHook = cli.Command{ + Name: "hook", + Usage: "Delegate commands to corresponding Git hooks", + Description: "This should only be called by Git", + Flags: []cli.Flag{ + cli.StringFlag{ + Name: "config, c", + Value: "custom/conf/app.ini", + Usage: "Custom configuration file path", + }, + }, + Subcommands: []cli.Command{ + subcmdHookPreReceive, + subcmdHookUpadte, + subcmdHookPostReceive, + }, + } + + subcmdHookPreReceive = cli.Command{ + Name: "pre-receive", + Usage: "Delegate pre-receive Git hook", + Description: "This command should only be called by Git", + Action: runHookPreReceive, + } + subcmdHookUpadte = cli.Command{ + Name: "update", + Usage: "Delegate update Git hook", + Description: "This command should only be called by Git", + Action: runHookUpdate, + } + subcmdHookPostReceive = cli.Command{ + Name: "post-receive", + Usage: "Delegate post-receive Git hook", + Description: "This command should only be called by Git", + Action: runHookPostReceive, + } +) + +func runHookPreReceive(c *cli.Context) error { + if len(os.Getenv("SSH_ORIGINAL_COMMAND")) == 0 { + return nil + } + if err := setup("hooks/pre-receive.log"); err != nil { + fail("Hook pre-receive init failed", fmt.Sprintf("setup: %v", err)) + } + + return nil +} + +func runHookUpdate(c *cli.Context) error { + if len(os.Getenv("SSH_ORIGINAL_COMMAND")) == 0 { + return nil + } + + if err := setup("hooks/update.log"); err != nil { + fail("Hook update init failed", fmt.Sprintf("setup: %v", err)) + } + + args := c.Args() + if len(args) != 3 { + fail("Arguments received are not equal to three", "Arguments received are not equal to three") + } else if len(args[0]) == 0 { + fail("First argument 'refName' is empty", "First argument 'refName' is empty") + } + + uuid := os.Getenv(envUpdateTaskUUID) + if err := models.AddUpdateTask(&models.UpdateTask{ + UUID: uuid, + RefName: args[0], + OldCommitID: args[1], + NewCommitID: args[2], + }); err != nil { + fail("Internal error", "Fail to add update task '%s': %v", uuid, err) + } + + return nil +} + +func runHookPostReceive(c *cli.Context) error { + if len(os.Getenv("SSH_ORIGINAL_COMMAND")) == 0 { + return nil + } + + if err := setup("hooks/post-receive.log"); err != nil { + fail("Hook post-receive init failed", fmt.Sprintf("setup: %v", err)) + } + + return nil +} diff --git a/cmd/serv.go b/cmd/serv.go new file mode 100644 index 0000000000..141a58a2ac --- /dev/null +++ b/cmd/serv.go @@ -0,0 +1,373 @@ +// Copyright 2014 The Gogs Authors. All rights reserved. +// Copyright 2016 The Gitea Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package cmd + +import ( + "crypto/tls" + "encoding/json" + "fmt" + "os" + "os/exec" + "path/filepath" + "strings" + "time" + + "code.gitea.io/git" + "code.gitea.io/gitea/models" + "code.gitea.io/gitea/modules/base" + "code.gitea.io/gitea/modules/httplib" + "code.gitea.io/gitea/modules/log" + "code.gitea.io/gitea/modules/setting" + "github.com/Unknwon/com" + "github.com/dgrijalva/jwt-go" + gouuid "github.com/satori/go.uuid" + "github.com/urfave/cli" +) + +const ( + accessDenied = "Repository does not exist or you do not have access" + lfsAuthenticateVerb = "git-lfs-authenticate" + envUpdateTaskUUID = "GITEA_UUID" +) + +// CmdServ represents the available serv sub-command. +var CmdServ = cli.Command{ + Name: "serv", + Usage: "This command should only be called by SSH shell", + Description: `Serv provide access auth for repositories`, + Action: runServ, + Flags: []cli.Flag{ + cli.StringFlag{ + Name: "config, c", + Value: "custom/conf/app.ini", + Usage: "Custom configuration file path", + }, + }, +} + +func setup(logPath string) error { + setting.NewContext() + log.NewGitLogger(filepath.Join(setting.LogRootPath, logPath)) + models.LoadConfigs() + + if setting.UseSQLite3 || setting.UseTiDB { + workDir, _ := setting.WorkDir() + if err := os.Chdir(workDir); err != nil { + log.GitLogger.Fatal(4, "Failed to change directory %s: %v", workDir, err) + } + } + + setting.NewXORMLogService(true) + return models.SetEngine() +} + +func parseCmd(cmd string) (string, string) { + ss := strings.SplitN(cmd, " ", 2) + if len(ss) != 2 { + return "", "" + } + return ss[0], strings.Replace(ss[1], "'/", "'", 1) +} + +var ( + allowedCommands = map[string]models.AccessMode{ + "git-upload-pack": models.AccessModeRead, + "git-upload-archive": models.AccessModeRead, + "git-receive-pack": models.AccessModeWrite, + lfsAuthenticateVerb: models.AccessModeNone, + } +) + +func fail(userMessage, logMessage string, args ...interface{}) { + fmt.Fprintln(os.Stderr, "Gitea:", userMessage) + + if len(logMessage) > 0 { + if !setting.ProdMode { + fmt.Fprintf(os.Stderr, logMessage+"\n", args...) + } + log.GitLogger.Fatal(3, logMessage, args...) + return + } + + log.GitLogger.Close() + os.Exit(1) +} + +func handleUpdateTask(uuid string, user, repoUser *models.User, reponame string, isWiki bool) { + task, err := models.GetUpdateTaskByUUID(uuid) + if err != nil { + if models.IsErrUpdateTaskNotExist(err) { + log.GitLogger.Trace("No update task is presented: %s", uuid) + return + } + log.GitLogger.Fatal(2, "GetUpdateTaskByUUID: %v", err) + } else if err = models.DeleteUpdateTaskByUUID(uuid); err != nil { + log.GitLogger.Fatal(2, "DeleteUpdateTaskByUUID: %v", err) + } + + if isWiki { + return + } + + if err = models.PushUpdate(models.PushUpdateOptions{ + RefFullName: task.RefName, + OldCommitID: task.OldCommitID, + NewCommitID: task.NewCommitID, + PusherID: user.ID, + PusherName: user.Name, + RepoUserName: repoUser.Name, + RepoName: reponame, + }); err != nil { + log.GitLogger.Error(2, "Update: %v", err) + } + + // Ask for running deliver hook and test pull request tasks. + reqURL := setting.LocalURL + repoUser.Name + "/" + reponame + "/tasks/trigger?branch=" + + strings.TrimPrefix(task.RefName, git.BranchPrefix) + "&secret=" + base.EncodeMD5(repoUser.Salt) + "&pusher=" + com.ToStr(user.ID) + log.GitLogger.Trace("Trigger task: %s", reqURL) + + resp, err := httplib.Head(reqURL).SetTLSClientConfig(&tls.Config{ + InsecureSkipVerify: true, + }).Response() + if err == nil { + resp.Body.Close() + if resp.StatusCode/100 != 2 { + log.GitLogger.Error(2, "Failed to trigger task: not 2xx response code") + } + } else { + log.GitLogger.Error(2, "Failed to trigger task: %v", err) + } +} + +func runServ(c *cli.Context) error { + if c.IsSet("config") { + setting.CustomConf = c.String("config") + } + + if err := setup("serv.log"); err != nil { + fail("System init failed", fmt.Sprintf("setup: %v", err)) + } + + if setting.SSH.Disabled { + println("Gitea: SSH has been disabled") + return nil + } + + if len(c.Args()) < 1 { + fail("Not enough arguments", "Not enough arguments") + } + + cmd := os.Getenv("SSH_ORIGINAL_COMMAND") + if len(cmd) == 0 { + println("Hi there, You've successfully authenticated, but Gitea does not provide shell access.") + println("If this is unexpected, please log in with password and setup Gitea under another user.") + return nil + } + + verb, args := parseCmd(cmd) + + var lfsVerb string + if verb == lfsAuthenticateVerb { + if !setting.LFS.StartServer { + fail("Unknown git command", "LFS authentication request over SSH denied, LFS support is disabled") + } + + if strings.Contains(args, " ") { + argsSplit := strings.SplitN(args, " ", 2) + args = strings.TrimSpace(argsSplit[0]) + lfsVerb = strings.TrimSpace(argsSplit[1]) + } + } + + repoPath := strings.ToLower(strings.Trim(args, "'")) + rr := strings.SplitN(repoPath, "/", 2) + if len(rr) != 2 { + fail("Invalid repository path", "Invalid repository path: %v", args) + } + username := strings.ToLower(rr[0]) + reponame := strings.ToLower(strings.TrimSuffix(rr[1], ".git")) + + isWiki := false + if strings.HasSuffix(reponame, ".wiki") { + isWiki = true + reponame = reponame[:len(reponame)-5] + } + + repoUser, err := models.GetUserByName(username) + if err != nil { + if models.IsErrUserNotExist(err) { + fail("Repository owner does not exist", "Unregistered owner: %s", username) + } + fail("Internal error", "Failed to get repository owner (%s): %v", username, err) + } + + repo, err := models.GetRepositoryByName(repoUser.ID, reponame) + if err != nil { + if models.IsErrRepoNotExist(err) { + fail(accessDenied, "Repository does not exist: %s/%s", repoUser.Name, reponame) + } + fail("Internal error", "Failed to get repository: %v", err) + } + + requestedMode, has := allowedCommands[verb] + if !has { + fail("Unknown git command", "Unknown git command %s", verb) + } + + if verb == lfsAuthenticateVerb { + if lfsVerb == "upload" { + requestedMode = models.AccessModeWrite + } else { + requestedMode = models.AccessModeRead + } + } + + // Prohibit push to mirror repositories. + if requestedMode > models.AccessModeRead && repo.IsMirror { + fail("mirror repository is read-only", "") + } + + // Allow anonymous clone for public repositories. + var ( + keyID int64 + user *models.User + ) + if requestedMode == models.AccessModeWrite || repo.IsPrivate { + keys := strings.Split(c.Args()[0], "-") + if len(keys) != 2 { + fail("Key ID format error", "Invalid key argument: %s", c.Args()[0]) + } + + key, err := models.GetPublicKeyByID(com.StrTo(keys[1]).MustInt64()) + if err != nil { + fail("Invalid key ID", "Invalid key ID[%s]: %v", c.Args()[0], err) + } + keyID = key.ID + + // Check deploy key or user key. + if key.Type == models.KeyTypeDeploy { + if key.Mode < requestedMode { + fail("Key permission denied", "Cannot push with deployment key: %d", key.ID) + } + // Check if this deploy key belongs to current repository. + if !models.HasDeployKey(key.ID, repo.ID) { + fail("Key access denied", "Deploy key access denied: [key_id: %d, repo_id: %d]", key.ID, repo.ID) + } + + // Update deploy key activity. + deployKey, err := models.GetDeployKeyByRepo(key.ID, repo.ID) + if err != nil { + fail("Internal error", "GetDeployKey: %v", err) + } + + deployKey.Updated = time.Now() + if err = models.UpdateDeployKey(deployKey); err != nil { + fail("Internal error", "UpdateDeployKey: %v", err) + } + } else { + user, err = models.GetUserByKeyID(key.ID) + if err != nil { + fail("internal error", "Failed to get user by key ID(%d): %v", keyID, err) + } + + mode, err := models.AccessLevel(user, repo) + if err != nil { + fail("Internal error", "Failed to check access: %v", err) + } else if mode < requestedMode { + clientMessage := accessDenied + if mode >= models.AccessModeRead { + clientMessage = "You do not have sufficient authorization for this action" + } + fail(clientMessage, + "User %s does not have level %v access to repository %s", + user.Name, requestedMode, repoPath) + } + + os.Setenv("GITEA_PUSHER_NAME", user.Name) + } + } + + //LFS token authentication + if verb == lfsAuthenticateVerb { + url := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, repoUser.Name, repo.Name) + + now := time.Now() + token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{ + "repo": repo.ID, + "op": lfsVerb, + "exp": now.Add(5 * time.Minute).Unix(), + "nbf": now.Unix(), + }) + + // Sign and get the complete encoded token as a string using the secret + tokenString, err := token.SignedString(setting.LFS.JWTSecretBytes) + if err != nil { + fail("Internal error", "Failed to sign JWT token: %v", err) + } + + tokenAuthentication := &models.LFSTokenResponse{ + Header: make(map[string]string), + Href: url, + } + tokenAuthentication.Header["Authorization"] = fmt.Sprintf("Bearer %s", tokenString) + + enc := json.NewEncoder(os.Stdout) + err = enc.Encode(tokenAuthentication) + if err != nil { + fail("Internal error", "Failed to encode LFS json response: %v", err) + } + + return nil + } + + uuid := gouuid.NewV4().String() + os.Setenv(envUpdateTaskUUID, uuid) + // Keep the old env variable name for backward compability + os.Setenv("uuid", uuid) + + // Special handle for Windows. + if setting.IsWindows { + verb = strings.Replace(verb, "-", " ", 1) + } + + var gitcmd *exec.Cmd + verbs := strings.Split(verb, " ") + if len(verbs) == 2 { + gitcmd = exec.Command(verbs[0], verbs[1], repoPath) + } else { + gitcmd = exec.Command(verb, repoPath) + } + + os.Setenv(models.ProtectedBranchAccessMode, requestedMode.String()) + os.Setenv(models.ProtectedBranchRepoID, fmt.Sprintf("%d", repo.ID)) + + gitcmd.Dir = setting.RepoRootPath + gitcmd.Stdout = os.Stdout + gitcmd.Stdin = os.Stdin + gitcmd.Stderr = os.Stderr + if err = gitcmd.Run(); err != nil { + fail("Internal error", "Failed to execute git command: %v", err) + } + + if requestedMode == models.AccessModeWrite { + handleUpdateTask(uuid, user, repoUser, reponame, isWiki) + } + + // Update user key activity. + if keyID > 0 { + key, err := models.GetPublicKeyByID(keyID) + if err != nil { + fail("Internal error", "GetPublicKeyById: %v", err) + } + + key.Updated = time.Now() + if err = models.UpdatePublicKey(key); err != nil { + fail("Internal error", "UpdatePublicKey: %v", err) + } + } + + return nil +} diff --git a/cmd/serve.go b/cmd/serve.go deleted file mode 100644 index f4a3c3d2c6..0000000000 --- a/cmd/serve.go +++ /dev/null @@ -1,375 +0,0 @@ -// Copyright 2014 The Gogs Authors. All rights reserved. -// Copyright 2016 The Gitea Authors. All rights reserved. -// Use of this source code is governed by a MIT-style -// license that can be found in the LICENSE file. - -package cmd - -import ( - "crypto/tls" - "encoding/json" - "fmt" - "os" - "os/exec" - "path/filepath" - "strings" - "time" - - "code.gitea.io/git" - "code.gitea.io/gitea/models" - "code.gitea.io/gitea/modules/base" - "code.gitea.io/gitea/modules/httplib" - "code.gitea.io/gitea/modules/log" - "code.gitea.io/gitea/modules/setting" - "github.com/Unknwon/com" - "github.com/dgrijalva/jwt-go" - gouuid "github.com/satori/go.uuid" - "github.com/urfave/cli" -) - -const ( - accessDenied = "Repository does not exist or you do not have access" - lfsAuthenticateVerb = "git-lfs-authenticate" -) - -// CmdServ represents the available serv sub-command. -var CmdServ = cli.Command{ - Name: "serv", - Usage: "This command should only be called by SSH shell", - Description: `Serv provide access auth for repositories`, - Action: runServ, - Flags: []cli.Flag{ - cli.StringFlag{ - Name: "config, c", - Value: "custom/conf/app.ini", - Usage: "Custom configuration file path", - }, - }, -} - -func setup(logPath string) error { - setting.NewContext() - log.NewGitLogger(filepath.Join(setting.LogRootPath, logPath)) - models.LoadConfigs() - - if setting.UseSQLite3 || setting.UseTiDB { - workDir, _ := setting.WorkDir() - if err := os.Chdir(workDir); err != nil { - log.GitLogger.Fatal(4, "Failed to change directory %s: %v", workDir, err) - } - } - - setting.NewXORMLogService(true) - return models.SetEngine() -} - -func parseCmd(cmd string) (string, string) { - ss := strings.SplitN(cmd, " ", 2) - if len(ss) != 2 { - return "", "" - } - return ss[0], strings.Replace(ss[1], "'/", "'", 1) -} - -var ( - allowedCommands = map[string]models.AccessMode{ - "git-upload-pack": models.AccessModeRead, - "git-upload-archive": models.AccessModeRead, - "git-receive-pack": models.AccessModeWrite, - lfsAuthenticateVerb: models.AccessModeNone, - } -) - -func fail(userMessage, logMessage string, args ...interface{}) { - fmt.Fprintln(os.Stderr, "Gitea:", userMessage) - - if len(logMessage) > 0 { - if !setting.ProdMode { - fmt.Fprintf(os.Stderr, logMessage+"\n", args...) - } - log.GitLogger.Fatal(3, logMessage, args...) - return - } - - log.GitLogger.Close() - os.Exit(1) -} - -func handleUpdateTask(uuid string, user, repoUser *models.User, reponame string, isWiki bool) { - task, err := models.GetUpdateTaskByUUID(uuid) - if err != nil { - if models.IsErrUpdateTaskNotExist(err) { - log.GitLogger.Trace("No update task is presented: %s", uuid) - return - } - log.GitLogger.Fatal(2, "GetUpdateTaskByUUID: %v", err) - } else if err = models.DeleteUpdateTaskByUUID(uuid); err != nil { - log.GitLogger.Fatal(2, "DeleteUpdateTaskByUUID: %v", err) - } - - if isWiki { - return - } - - if err = models.PushUpdate(models.PushUpdateOptions{ - RefFullName: task.RefName, - OldCommitID: task.OldCommitID, - NewCommitID: task.NewCommitID, - PusherID: user.ID, - PusherName: user.Name, - RepoUserName: repoUser.Name, - RepoName: reponame, - }); err != nil { - log.GitLogger.Error(2, "Update: %v", err) - } - - // Ask for running deliver hook and test pull request tasks. - reqURL := setting.LocalURL + repoUser.Name + "/" + reponame + "/tasks/trigger?branch=" + - strings.TrimPrefix(task.RefName, git.BranchPrefix) + "&secret=" + base.EncodeMD5(repoUser.Salt) + "&pusher=" + com.ToStr(user.ID) - log.GitLogger.Trace("Trigger task: %s", reqURL) - - resp, err := httplib.Head(reqURL).SetTLSClientConfig(&tls.Config{ - InsecureSkipVerify: true, - }).Response() - if err == nil { - resp.Body.Close() - if resp.StatusCode/100 != 2 { - log.GitLogger.Error(2, "Failed to trigger task: not 2xx response code") - } - } else { - log.GitLogger.Error(2, "Failed to trigger task: %v", err) - } -} - -func runServ(c *cli.Context) error { - if c.IsSet("config") { - setting.CustomConf = c.String("config") - } - - if err := setup("serv.log"); err != nil { - fail("System init failed", fmt.Sprintf("setup: %v", err)) - } - - if setting.SSH.Disabled { - println("Gitea: SSH has been disabled") - return nil - } - - if len(c.Args()) < 1 { - fail("Not enough arguments", "Not enough arguments") - } - - cmd := os.Getenv("SSH_ORIGINAL_COMMAND") - if len(cmd) == 0 { - println("Hi there, You've successfully authenticated, but Gitea does not provide shell access.") - println("If this is unexpected, please log in with password and setup Gitea under another user.") - return nil - } - - verb, args := parseCmd(cmd) - - var lfsVerb string - if verb == lfsAuthenticateVerb { - - if !setting.LFS.StartServer { - fail("Unknown git command", "LFS authentication request over SSH denied, LFS support is disabled") - } - - if strings.Contains(args, " ") { - argsSplit := strings.SplitN(args, " ", 2) - args = strings.TrimSpace(argsSplit[0]) - lfsVerb = strings.TrimSpace(argsSplit[1]) - } - } - - repoPath := strings.ToLower(strings.Trim(args, "'")) - rr := strings.SplitN(repoPath, "/", 2) - if len(rr) != 2 { - fail("Invalid repository path", "Invalid repository path: %v", args) - } - username := strings.ToLower(rr[0]) - reponame := strings.ToLower(strings.TrimSuffix(rr[1], ".git")) - - isWiki := false - if strings.HasSuffix(reponame, ".wiki") { - isWiki = true - reponame = reponame[:len(reponame)-5] - } - - repoUser, err := models.GetUserByName(username) - if err != nil { - if models.IsErrUserNotExist(err) { - fail("Repository owner does not exist", "Unregistered owner: %s", username) - } - fail("Internal error", "Failed to get repository owner (%s): %v", username, err) - } - - repo, err := models.GetRepositoryByName(repoUser.ID, reponame) - if err != nil { - if models.IsErrRepoNotExist(err) { - fail(accessDenied, "Repository does not exist: %s/%s", repoUser.Name, reponame) - } - fail("Internal error", "Failed to get repository: %v", err) - } - - requestedMode, has := allowedCommands[verb] - if !has { - fail("Unknown git command", "Unknown git command %s", verb) - } - - if verb == lfsAuthenticateVerb { - if lfsVerb == "upload" { - requestedMode = models.AccessModeWrite - } else { - requestedMode = models.AccessModeRead - } - } - - // Prohibit push to mirror repositories. - if requestedMode > models.AccessModeRead && repo.IsMirror { - fail("mirror repository is read-only", "") - } - - // Allow anonymous clone for public repositories. - var ( - keyID int64 - user *models.User - ) - if requestedMode == models.AccessModeWrite || repo.IsPrivate { - keys := strings.Split(c.Args()[0], "-") - if len(keys) != 2 { - fail("Key ID format error", "Invalid key argument: %s", c.Args()[0]) - } - - key, err := models.GetPublicKeyByID(com.StrTo(keys[1]).MustInt64()) - if err != nil { - fail("Invalid key ID", "Invalid key ID[%s]: %v", c.Args()[0], err) - } - keyID = key.ID - - // Check deploy key or user key. - if key.Type == models.KeyTypeDeploy { - if key.Mode < requestedMode { - fail("Key permission denied", "Cannot push with deployment key: %d", key.ID) - } - // Check if this deploy key belongs to current repository. - if !models.HasDeployKey(key.ID, repo.ID) { - fail("Key access denied", "Deploy key access denied: [key_id: %d, repo_id: %d]", key.ID, repo.ID) - } - - // Update deploy key activity. - deployKey, err := models.GetDeployKeyByRepo(key.ID, repo.ID) - if err != nil { - fail("Internal error", "GetDeployKey: %v", err) - } - - deployKey.Updated = time.Now() - if err = models.UpdateDeployKey(deployKey); err != nil { - fail("Internal error", "UpdateDeployKey: %v", err) - } - } else { - user, err = models.GetUserByKeyID(key.ID) - if err != nil { - fail("internal error", "Failed to get user by key ID(%d): %v", keyID, err) - } - - mode, err := models.AccessLevel(user, repo) - if err != nil { - fail("Internal error", "Failed to check access: %v", err) - } else if mode < requestedMode { - clientMessage := accessDenied - if mode >= models.AccessModeRead { - clientMessage = "You do not have sufficient authorization for this action" - } - fail(clientMessage, - "User %s does not have level %v access to repository %s", - user.Name, requestedMode, repoPath) - } - - os.Setenv("GITEA_PUSHER_NAME", user.Name) - } - } - - //LFS token authentication - - if verb == lfsAuthenticateVerb { - - url := fmt.Sprintf("%s%s/%s.git/info/lfs", setting.AppURL, repoUser.Name, repo.Name) - - now := time.Now() - token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{ - "repo": repo.ID, - "op": lfsVerb, - "exp": now.Add(5 * time.Minute).Unix(), - "nbf": now.Unix(), - }) - - // Sign and get the complete encoded token as a string using the secret - tokenString, err := token.SignedString(setting.LFS.JWTSecretBytes) - if err != nil { - fail("Internal error", "Failed to sign JWT token: %v", err) - } - - tokenAuthentication := &models.LFSTokenResponse{ - Header: make(map[string]string), - Href: url, - } - tokenAuthentication.Header["Authorization"] = fmt.Sprintf("Bearer %s", tokenString) - - enc := json.NewEncoder(os.Stdout) - err = enc.Encode(tokenAuthentication) - if err != nil { - fail("Internal error", "Failed to encode LFS json response: %v", err) - } - - return nil - } - - uuid := gouuid.NewV4().String() - os.Setenv("GITEA_UUID", uuid) - // Keep the old env variable name for backward compability - os.Setenv("uuid", uuid) - - // Special handle for Windows. - if setting.IsWindows { - verb = strings.Replace(verb, "-", " ", 1) - } - - var gitcmd *exec.Cmd - verbs := strings.Split(verb, " ") - if len(verbs) == 2 { - gitcmd = exec.Command(verbs[0], verbs[1], repoPath) - } else { - gitcmd = exec.Command(verb, repoPath) - } - - os.Setenv(models.ProtectedBranchAccessMode, requestedMode.String()) - os.Setenv(models.ProtectedBranchRepoID, fmt.Sprintf("%d", repo.ID)) - - gitcmd.Dir = setting.RepoRootPath - gitcmd.Stdout = os.Stdout - gitcmd.Stdin = os.Stdin - gitcmd.Stderr = os.Stderr - if err = gitcmd.Run(); err != nil { - fail("Internal error", "Failed to execute git command: %v", err) - } - - if requestedMode == models.AccessModeWrite { - handleUpdateTask(uuid, user, repoUser, reponame, isWiki) - } - - // Update user key activity. - if keyID > 0 { - key, err := models.GetPublicKeyByID(keyID) - if err != nil { - fail("Internal error", "GetPublicKeyById: %v", err) - } - - key.Updated = time.Now() - if err = models.UpdatePublicKey(key); err != nil { - fail("Internal error", "UpdatePublicKey: %v", err) - } - } - - return nil -} diff --git a/main.go b/main.go index d41fb4f6f8..b7e8244b4b 100644 --- a/main.go +++ b/main.go @@ -30,7 +30,7 @@ func main() { app.Commands = []cli.Command{ cmd.CmdWeb, cmd.CmdServ, - cmd.CmdUpdate, + cmd.CmdHook, cmd.CmdDump, cmd.CmdCert, cmd.CmdAdmin, diff --git a/models/migrations/migrations.go b/models/migrations/migrations.go index 2a1c70af77..5ae139cb3f 100644 --- a/models/migrations/migrations.go +++ b/models/migrations/migrations.go @@ -86,6 +86,8 @@ var migrations = []Migration{ NewMigration("set protect branches updated with created", setProtectedBranchUpdatedWithCreated), // v18 -> v19 NewMigration("add external login user", addExternalLoginUser), + // v19 -> v20 + NewMigration("generate and migrate Git hooks", generateAndMigrateGitHooks), } // Migrate database to current version diff --git a/models/migrations/v18.go b/models/migrations/v18.go index be51615341..3b3cd23ccf 100644 --- a/models/migrations/v18.go +++ b/models/migrations/v18.go @@ -13,8 +13,8 @@ import ( // ExternalLoginUser makes the connecting between some existing user and additional external login sources type ExternalLoginUser struct { ExternalID string `xorm:"NOT NULL"` - UserID int64 `xorm:"NOT NULL"` - LoginSourceID int64 `xorm:"NOT NULL"` + UserID int64 `xorm:"NOT NULL"` + LoginSourceID int64 `xorm:"NOT NULL"` } func addExternalLoginUser(x *xorm.Engine) error { diff --git a/models/migrations/v19.go b/models/migrations/v19.go new file mode 100644 index 0000000000..6e0dbedaa3 --- /dev/null +++ b/models/migrations/v19.go @@ -0,0 +1,85 @@ +// Copyright 2017 The Gitea Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package migrations + +import ( + "fmt" + "io/ioutil" + "os" + "path/filepath" + "strings" + + "code.gitea.io/gitea/modules/setting" + + "github.com/Unknwon/com" + "github.com/go-xorm/xorm" +) + +func generateAndMigrateGitHooks(x *xorm.Engine) (err error) { + type Repository struct { + ID int64 + OwnerID int64 + Name string + } + type User struct { + ID int64 + Name string + } + + var ( + hookNames = []string{"pre-receive", "update", "post-receive"} + hookTpls = []string{ + fmt.Sprintf("#!/usr/bin/env %s\nORI_DIR=`pwd`\nSHELL_FOLDER=$(cd \"$(dirname \"$0\")\";pwd)\ncd \"$ORI_DIR\"\nfor i in `ls \"$SHELL_FOLDER/pre-receive.d\"`; do\n sh \"$SHELL_FOLDER/pre-receive.d/$i\"\ndone", setting.ScriptType), + fmt.Sprintf("#!/usr/bin/env %s\nORI_DIR=`pwd`\nSHELL_FOLDER=$(cd \"$(dirname \"$0\")\";pwd)\ncd \"$ORI_DIR\"\nfor i in `ls \"$SHELL_FOLDER/update.d\"`; do\n sh \"$SHELL_FOLDER/update.d/$i\" $1 $2 $3\ndone", setting.ScriptType), + fmt.Sprintf("#!/usr/bin/env %s\nORI_DIR=`pwd`\nSHELL_FOLDER=$(cd \"$(dirname \"$0\")\";pwd)\ncd \"$ORI_DIR\"\nfor i in `ls \"$SHELL_FOLDER/post-receive.d\"`; do\n sh \"$SHELL_FOLDER/post-receive.d/$i\"\ndone", setting.ScriptType), + } + giteaHookTpls = []string{ + fmt.Sprintf("#!/usr/bin/env %s\n\"%s\" hook --config='%s' pre-receive\n", setting.ScriptType, setting.AppPath, setting.CustomConf), + fmt.Sprintf("#!/usr/bin/env %s\n\"%s\" hook --config='%s' update $1 $2 $3\n", setting.ScriptType, setting.AppPath, setting.CustomConf), + fmt.Sprintf("#!/usr/bin/env %s\n\"%s\" hook --config='%s' post-receive\n", setting.ScriptType, setting.AppPath, setting.CustomConf), + } + ) + + return x.Where("id > 0").Iterate(new(Repository), + func(idx int, bean interface{}) error { + repo := bean.(*Repository) + user := new(User) + has, err := x.Where("id = ?", repo.OwnerID).Get(user) + if err != nil { + return fmt.Errorf("query owner of repository [repo_id: %d, owner_id: %d]: %v", repo.ID, repo.OwnerID, err) + } else if !has { + return nil + } + + repoPath := filepath.Join(setting.RepoRootPath, strings.ToLower(user.Name), strings.ToLower(repo.Name)) + ".git" + hookDir := filepath.Join(repoPath, "hooks") + + for i, hookName := range hookNames { + oldHookPath := filepath.Join(hookDir, hookName) + newHookPath := filepath.Join(hookDir, hookName+".d", "gitea") + + if err = os.MkdirAll(filepath.Join(hookDir, hookName+".d"), os.ModePerm); err != nil { + return fmt.Errorf("create hooks dir '%s': %v", filepath.Join(hookDir, hookName+".d"), err) + } + + // WARNING: Old server-side hooks will be moved to sub directory with the same name + if hookName != "update" && com.IsExist(oldHookPath) { + newPlace := filepath.Join(hookDir, hookName+".d", hookName) + if err = os.Rename(oldHookPath, newPlace); err != nil { + return fmt.Errorf("Remove old hook file '%s' to '%s': %v", oldHookPath, newPlace, err) + } + } + + if err = ioutil.WriteFile(oldHookPath, []byte(hookTpls[i]), 0777); err != nil { + return fmt.Errorf("write old hook file '%s': %v", oldHookPath, err) + } + + if err = ioutil.WriteFile(newHookPath, []byte(giteaHookTpls[i]), 0777); err != nil { + return fmt.Errorf("write new hook file '%s': %v", oldHookPath, err) + } + } + return nil + }) +} diff --git a/models/repo.go b/models/repo.go index af8f688339..e276a87ae6 100644 --- a/models/repo.go +++ b/models/repo.go @@ -831,20 +831,54 @@ func cleanUpMigrateGitConfig(configPath string) error { return nil } -func createUpdateHook(repoPath string) error { - return git.SetUpdateHook(repoPath, - fmt.Sprintf(tplUpdateHook, setting.ScriptType, "\""+setting.AppPath+"\"", setting.CustomConf)) +// createDelegateHooks creates all the hooks scripts for the repo +func createDelegateHooks(repoPath string) (err error) { + var ( + hookNames = []string{"pre-receive", "update", "post-receive"} + hookTpls = []string{ + fmt.Sprintf("#!/usr/bin/env %s\nORI_DIR=`pwd`\nSHELL_FOLDER=$(cd \"$(dirname \"$0\")\";pwd)\ncd \"$ORI_DIR\"\nfor i in `ls \"$SHELL_FOLDER/pre-receive.d\"`; do\n sh \"$SHELL_FOLDER/pre-receive.d/$i\"\ndone", setting.ScriptType), + fmt.Sprintf("#!/usr/bin/env %s\nORI_DIR=`pwd`\nSHELL_FOLDER=$(cd \"$(dirname \"$0\")\";pwd)\ncd \"$ORI_DIR\"\nfor i in `ls \"$SHELL_FOLDER/update.d\"`; do\n sh \"$SHELL_FOLDER/update.d/$i\" $1 $2 $3\ndone", setting.ScriptType), + fmt.Sprintf("#!/usr/bin/env %s\nORI_DIR=`pwd`\nSHELL_FOLDER=$(cd \"$(dirname \"$0\")\";pwd)\ncd \"$ORI_DIR\"\nfor i in `ls \"$SHELL_FOLDER/post-receive.d\"`; do\n sh \"$SHELL_FOLDER/post-receive.d/$i\"\ndone", setting.ScriptType), + } + giteaHookTpls = []string{ + fmt.Sprintf("#!/usr/bin/env %s\n\"%s\" hook --config='%s' pre-receive\n", setting.ScriptType, setting.AppPath, setting.CustomConf), + fmt.Sprintf("#!/usr/bin/env %s\n\"%s\" hook --config='%s' update $1 $2 $3\n", setting.ScriptType, setting.AppPath, setting.CustomConf), + fmt.Sprintf("#!/usr/bin/env %s\n\"%s\" hook --config='%s' post-receive\n", setting.ScriptType, setting.AppPath, setting.CustomConf), + } + ) + + hookDir := filepath.Join(repoPath, "hooks") + + for i, hookName := range hookNames { + oldHookPath := filepath.Join(hookDir, hookName) + newHookPath := filepath.Join(hookDir, hookName+".d", "gitea") + + if err := os.MkdirAll(filepath.Join(hookDir, hookName+".d"), os.ModePerm); err != nil { + return fmt.Errorf("create hooks dir '%s': %v", filepath.Join(hookDir, hookName+".d"), err) + } + + // WARNING: This will override all old server-side hooks + if err = ioutil.WriteFile(oldHookPath, []byte(hookTpls[i]), 0777); err != nil { + return fmt.Errorf("write old hook file '%s': %v", oldHookPath, err) + } + + if err = ioutil.WriteFile(newHookPath, []byte(giteaHookTpls[i]), 0777); err != nil { + return fmt.Errorf("write new hook file '%s': %v", newHookPath, err) + } + } + + return nil } // CleanUpMigrateInfo finishes migrating repository and/or wiki with things that don't need to be done for mirrors. func CleanUpMigrateInfo(repo *Repository) (*Repository, error) { repoPath := repo.RepoPath() - if err := createUpdateHook(repoPath); err != nil { - return repo, fmt.Errorf("createUpdateHook: %v", err) + if err := createDelegateHooks(repoPath); err != nil { + return repo, fmt.Errorf("createDelegateHooks: %v", err) } if repo.HasWiki() { - if err := createUpdateHook(repo.WikiPath()); err != nil { - return repo, fmt.Errorf("createUpdateHook (wiki): %v", err) + if err := createDelegateHooks(repo.WikiPath()); err != nil { + return repo, fmt.Errorf("createDelegateHooks.(wiki): %v", err) } } @@ -994,8 +1028,8 @@ func initRepository(e Engine, repoPath string, u *User, repo *Repository, opts C // Init bare new repository. if err = git.InitRepository(repoPath, true); err != nil { return fmt.Errorf("InitRepository: %v", err) - } else if err = createUpdateHook(repoPath); err != nil { - return fmt.Errorf("createUpdateHook: %v", err) + } else if err = createDelegateHooks(repoPath); err != nil { + return fmt.Errorf("createDelegateHooks: %v", err) } tmpDir := filepath.Join(os.TempDir(), "gitea-"+repo.Name+"-"+com.ToStr(time.Now().Nanosecond())) @@ -2009,15 +2043,16 @@ func ReinitMissingRepositories() error { return nil } -// RewriteRepositoryUpdateHook rewrites all repositories' update hook. -func RewriteRepositoryUpdateHook() error { - return x. - Where("id > 0"). - Iterate(new(Repository), - func(idx int, bean interface{}) error { - repo := bean.(*Repository) - return createUpdateHook(repo.RepoPath()) - }) +// SyncRepositoryHooks rewrites all repositories' pre-receive, update and post-receive hooks +// to make sure the binary and custom conf path are up-to-date. +func SyncRepositoryHooks() error { + return x.Where("id > 0").Iterate(new(Repository), + func(idx int, bean interface{}) error { + if err := createDelegateHooks(bean.(*Repository).RepoPath()); err != nil { + return fmt.Errorf("SyncRepositoryHook: %v", err) + } + return nil + }) } // Prevent duplicate running tasks. @@ -2345,8 +2380,8 @@ func ForkRepository(u *User, oldRepo *Repository, name, desc string) (_ *Reposit return nil, fmt.Errorf("git update-server-info: %v", stderr) } - if err = createUpdateHook(repoPath); err != nil { - return nil, fmt.Errorf("createUpdateHook: %v", err) + if err = createDelegateHooks(repoPath); err != nil { + return nil, fmt.Errorf("createDelegateHooks: %v", err) } //Commit repo to get Fork ID diff --git a/models/wiki.go b/models/wiki.go index 39e4b2a443..690da707c6 100644 --- a/models/wiki.go +++ b/models/wiki.go @@ -69,8 +69,8 @@ func (repo *Repository) InitWiki() error { if err := git.InitRepository(repo.WikiPath(), true); err != nil { return fmt.Errorf("InitRepository: %v", err) - } else if err = createUpdateHook(repo.WikiPath()); err != nil { - return fmt.Errorf("createUpdateHook: %v", err) + } else if err = createDelegateHooks(repo.WikiPath()); err != nil { + return fmt.Errorf("createDelegateHooks: %v", err) } return nil } diff --git a/options/locale/locale_en-US.ini b/options/locale/locale_en-US.ini index 661a44caf5..9043ff12b6 100644 --- a/options/locale/locale_en-US.ini +++ b/options/locale/locale_en-US.ini @@ -1003,8 +1003,8 @@ dashboard.git_gc_repos = Do garbage collection on repositories dashboard.git_gc_repos_success = All repositories have done garbage collection successfully. dashboard.resync_all_sshkeys = Rewrite '.ssh/authorized_keys' file (caution: non-Gitea keys will be lost) dashboard.resync_all_sshkeys_success = All public keys have been rewritten successfully. -dashboard.resync_all_update_hooks = Rewrite all update hook of repositories (needed when custom config path is changed) -dashboard.resync_all_update_hooks_success = All repositories' update hook have been rewritten successfully. +dashboard.resync_all_hooks = Resync pre-receive, update and post-receive hooks of all repositories. +dashboard.resync_all_hooks_success = All repositories' pre-receive, update and post-receive hooks have been resynced successfully. dashboard.reinit_missing_repos = Reinitialize all repository records that lost Git files dashboard.reinit_missing_repos_success = All repository records that lost Git files have been reinitialized successfully. diff --git a/routers/admin/admin.go b/routers/admin/admin.go index 7158a4ee91..6b5b33f734 100644 --- a/routers/admin/admin.go +++ b/routers/admin/admin.go @@ -152,8 +152,8 @@ func Dashboard(ctx *context.Context) { success = ctx.Tr("admin.dashboard.resync_all_sshkeys_success") err = models.RewriteAllPublicKeys() case syncRepositoryUpdateHook: - success = ctx.Tr("admin.dashboard.resync_all_update_hooks_success") - err = models.RewriteRepositoryUpdateHook() + success = ctx.Tr("admin.dashboard.resync_all_hooks_success") + err = models.SyncRepositoryHooks() case reinitMissingRepository: success = ctx.Tr("admin.dashboard.reinit_missing_repos_success") err = models.ReinitMissingRepositories() diff --git a/templates/admin/dashboard.tmpl b/templates/admin/dashboard.tmpl index af4563a02d..acffdc4314 100644 --- a/templates/admin/dashboard.tmpl +++ b/templates/admin/dashboard.tmpl @@ -40,7 +40,7 @@ {{.i18n.Tr "admin.dashboard.operation_run"}} - {{.i18n.Tr "admin.dashboard.resync_all_update_hooks"}} + {{.i18n.Tr "admin.dashboard.resync_all_hooks"}} {{.i18n.Tr "admin.dashboard.operation_run"}} diff --git a/vendor/code.gitea.io/git/hook.go b/vendor/code.gitea.io/git/hook.go index d8069b6b82..afed623e6e 100644 --- a/vendor/code.gitea.io/git/hook.go +++ b/vendor/code.gitea.io/git/hook.go @@ -9,6 +9,7 @@ import ( "io/ioutil" "os" "path" + "path/filepath" "strings" "github.com/Unknwon/com" @@ -17,7 +18,7 @@ import ( // hookNames is a list of Git server hooks' name that are supported. var hookNames = []string{ "pre-receive", - // "update", + "update", "post-receive", } @@ -52,8 +53,9 @@ func GetHook(repoPath, name string) (*Hook, error) { } h := &Hook{ name: name, - path: path.Join(repoPath, "hooks", name), + path: path.Join(repoPath, "hooks", name+".d", name), } + samplePath := filepath.Join(repoPath, "hooks", name+".sample") if isFile(h.path) { data, err := ioutil.ReadFile(h.path) if err != nil { @@ -61,8 +63,8 @@ func GetHook(repoPath, name string) (*Hook, error) { } h.IsActive = true h.Content = string(data) - } else if isFile(h.path + ".sample") { - data, err := ioutil.ReadFile(h.path + ".sample") + } else if isFile(samplePath) { + data, err := ioutil.ReadFile(samplePath) if err != nil { return nil, err } diff --git a/vendor/code.gitea.io/git/repo_blame.go b/vendor/code.gitea.io/git/repo_blame.go new file mode 100644 index 0000000000..b48cbeea6c --- /dev/null +++ b/vendor/code.gitea.io/git/repo_blame.go @@ -0,0 +1,10 @@ +// Copyright 2017 The Gitea Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package git + +// FileBlame return the Blame object of file +func (repo *Repository) FileBlame(revision, path, file string) ([]byte, error) { + return NewCommand("blame", "--root", file).RunInDirBytes(path) +} diff --git a/vendor/vendor.json b/vendor/vendor.json index 49dcec8c45..3a4ebc5780 100644 --- a/vendor/vendor.json +++ b/vendor/vendor.json @@ -3,10 +3,10 @@ "ignore": "test", "package": [ { - "checksumSHA1": "km1AOUs34DCwgXT55fh6PrkPdiU=", + "checksumSHA1": "nt2y/SNJe3Rl0tzdaEyGQfCc4L4=", "path": "code.gitea.io/git", - "revision": "dd951bf625ebf5c16ef403f681aaec6c34324bca", - "revisionTime": "2017-02-05T02:50:57Z" + "revision": "b4c06a53d0f619e84a99eb042184663d4ad8a32b", + "revisionTime": "2017-02-22T02:52:05Z" }, { "checksumSHA1": "BKj0haFTDebzdC2nACpoGzp3s8A=", -- cgit v1.2.3