This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "FusionForge".
The branch, 6.1 has been updated
via d5aff7fbf73b2a514631e1d8d29489b2019bd51a (commit)
via 306ed594181fdc7e72bcd91975482058adb5b748 (commit)
from 66b535edf0fc82bb7df9a87aed7953100b5cbb0e (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
https://scm.fusionforge.org/anonscm/gitweb/?p=fusionforge/fusionforge.git;a=commitdiff;h=d5aff7fbf73b2a514631e1d8d29489b2019bd51a
commit d5aff7fbf73b2a514631e1d8d29489b2019bd51a
Author: Franck Villaume <[email protected]>
Date: Sat Jan 20 11:00:51 2018 +0100
Introduce limited_ssh preview feature: replace a full ssh access by a
selected list of ssh supported commands
diff --git a/src/GNUmakefile b/src/GNUmakefile
index 02c90fc..aef4b12 100644
--- a/src/GNUmakefile
+++ b/src/GNUmakefile
@@ -1,7 +1,7 @@
# FusionForge build system
#
# Copyright (C) 2014, 2015 Inria (Sylvain Beucler)
-# Copyright 2017, Franck Villaume - TrivialDev
+# Copyright 2017-2018, Franck Villaume - TrivialDev
#
# This file is part of FusionForge. FusionForge is free software;
# you can redistribute it and/or modify it under the terms of the
@@ -130,6 +130,7 @@ install-scm: install-base-dirs
fi
install-shell: install-base-dirs
+ ln -nfs $(pkgdatadir)/bin/limited_ssh.sh $(DESTDIR)$(bindir)
$(CP_R) cronjobs/shell $(DESTDIR)$(pkgdatadir)/cronjobs/
$(CP_R) post-install.d/shell $(DESTDIR)$(pkgdatadir)/post-install.d/
diff --git a/src/bin/limited_ssh.sh b/src/bin/limited_ssh.sh
new file mode 100644
index 0000000..6be2d0f
--- /dev/null
+++ b/src/bin/limited_ssh.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+
+# -------------------------------------------------------------------
+# Copyright (C) 2006 by Intevation GmbH
+# Author(s):
+# Sascha Wilde <[email protected]>
+# Mathias Gebbe <[email protected]>
+
+# Copyright 2018, Franck Villaume - TrivialDev
+
+# This program is free software under the GNU GPL (>=v2)
+# Read the file COPYING coming with the software for details.
+# -------------------------------------------------------------------
+# Only allow well defined actions...
+
+# WARNING:
+# This script does by no means enforce hard security policies. As
+# long as users are allowed to install PHP scripts on this server it
+# would be pointless anyway..!
+
+COMMAND=`echo "$SSH_ORIGINAL_COMMAND" | cut -f1 -d' '`
+
+RSYNC=/usr/bin/rsync
+RSYNC_BASE_DIR=$(forge_get_config groupdir_prefix)
+
+SVN=/usr/bin/svnserve
+SVN_BASE_DIR=$(forge_get_config repos_path scmsvn)
+
+HG=/usr/bin/hg
+HG_BASE_DIR=$(forge_get_config repos_path scmhg)
+
+GIT=/usr/bin/git
+GIT_BASE_DIR=$(forge_get_config repos_path scmgit)
+
+LOG="logger -t limited_ssh -p local0.info"
+CHAR_WHITELIST="\\\\a-zA-Z0-9 \"\!\?~+()[]{}'/@%,._-"
+
+normalize-path()
+# $1 => base-path
+# $2 => path relative to basepath
+{
+ NEWPATH=`readlink -f "$1/$2"` || \
+ NEWPATH=`readlink -f "$1"/$(dirname "$2")`/$(basename "$2") || \
+ exit 1
+ TRAIL=`echo $2 | sed 's/.*\(.\)$/\1/' | tr -cd /`
+ NEWPATH="$NEWPATH$TRAIL"
+ echo "$NEWPATH" | grep "$1" || exit 1
+}
+
+fail()
+{
+ $LOG -s "FAILED: $1"
+ exit 1
+}
+
+$LOG "Called by $USER with: $SSH_ORIGINAL_COMMAND"
+case "$COMMAND" in
+ rsync)
+ # Remove the -L] option
+ SSH_ORIGINAL_COMMAND=`echo "$SSH_ORIGINAL_COMMAND" \
+ | sed -e 's/ \(-.*\)L/ \1/'`
+
+ # check for evil characters:
+ [ -z `echo "$SSH_ORIGINAL_COMMAND" | \
+ tr -d "$CHAR_WHITELIST"` ] || \
+ fail "illegal characters in command"
+
+ # extract options and destination path and last char from path
+ roptions=`echo "$SSH_ORIGINAL_COMMAND" \
+ | sed -n 's/rsync \([^.]*\)\([^/]*\).*/\1\2/p'`
+
+ rpath=`echo "$SSH_ORIGINAL_COMMAND" \
+ | sed -n 's/rsync [^.]*.*[^.]* \.[ \t]*\(.*\)/\1/p'`
+
+ $LOG "option: $roptions and path: $rpath"
+ newpath=$(normalize-path "$RSYNC_BASE_DIR" "$rpath") \
+ || fail "illegal path \"$rpath\""
+
+ # don't let them fool us:
+ echo "$roptions" | grep -q -- '--server' || fail "illegal operation"
+
+ EXEC="$RSYNC $roptions $newpath"
+ ;;
+ svnserve)
+ EXEC="$SVN -t -r $SVN_BASE_DIR"
+ ;;
+ hg)
+ # do hg ssh
+ # check if all starts with hg -R "/"hg/ and test if this exist under
$HG_BASE_DIR
+ hpath=`echo "$SSH_ORIGINAL_COMMAND" | \
+ sed -n 's/hg -R \/*hg\/\([^ ]*\).*/\1/p'`
+ $LOG "hpath: ".$HG_BASE_DIR/$hpath
+ if [ "$hpath" == "" ] || [ ! -d "$HG_BASE_DIR/$hpath" ]
+ then
+ fail "Repository not found"
+ fi
+ EXEC="$HG -R $HG_BASE_DIR/$hpath serve --stdio"
+ ;;
+ git)
+ #TODO
+ fail "not yet implemented".$SSH_ORIGINAL_COMMAND
+ ;;
+ *)
+ fail "operation not permitted"
+ ;;
+esac
+
+$LOG "Executing: $EXEC"
+eval exec $EXEC
diff --git a/src/common/include/User.class.php
b/src/common/include/User.class.php
index bc67da8..f1e449b 100644
--- a/src/common/include/User.class.php
+++ b/src/common/include/User.class.php
@@ -1247,6 +1247,9 @@ class FFUser extends FFError {
$fingerprint = $returnExecExploded[1];
$now = time();
$explodedKey = explode(' ', $key);
+ if (forge_get_config('use_shell_limited')) {
+ $key = preg_replace("/^.*ssh-/",
"command=\"\/usr\/local\/bin\/limited_ssh.sh\" ssh-", $key);
+ }
$existingKeys = $this->getAuthorizedKeys();
foreach ($existingKeys as $existingKey) {
if ($existingKey['fingerprint'] == $fingerprint) {
diff --git a/src/etc/config.ini.d/defaults.ini
b/src/etc/config.ini.d/defaults.ini
index 1d52c6d..f321025 100644
--- a/src/etc/config.ini.d/defaults.ini
+++ b/src/etc/config.ini.d/defaults.ini
@@ -76,6 +76,7 @@ use_scm_snapshots = true
use_scm_tarballs = true
allow_multiple_scm = no
use_shell = yes
+use_shell_limited = no
use_snippet = yes
use_ssl = yes
use_survey = yes
diff --git a/src/plugins/scmhg/common/HgPlugin.class.php
b/src/plugins/scmhg/common/HgPlugin.class.php
index 46a92fb..391d8b6 100644
--- a/src/plugins/scmhg/common/HgPlugin.class.php
+++ b/src/plugins/scmhg/common/HgPlugin.class.php
@@ -121,7 +121,12 @@ Offer DAV or SSH access.");
foreach ($repo_list as $repo_name) {
// Warning : the ssh uri MUST be this
form : ssh://username@scmbox//path/reponame
// HAVE YOU SEEN THE //
starting the path ? Keep in mind the double /
- $htmlRepo .= html_e('kbd', array(), 'hg
clone
ssh://'.$d.'@'.$this->getBoxForProject($project).$ssh_port.'/'.forge_get_config('repos_path',
'scmhg').'/'.$project->getUnixName()).html_e('br');
+ if
(forge_get_config('use_shell_limited')) {
+ $htmlRepo .= html_e('kbd',
array(), 'hg clone
ssh://'.$d.'@'.$this->getBoxForProject($project).$ssh_port'/hg/'.$project->getUnixName()).html_e('br');
+
+ } else {
+ $htmlRepo .= html_e('kbd',
array(), 'hg clone
ssh://'.$d.'@'.$this->getBoxForProject($project).$ssh_port.'/'.forge_get_config('repos_path',
'scmhg').'/'.$project->getUnixName()).html_e('br');
+ }
}
$b .= html_e('p', array(), $htmlRepo);
$b .= '</div>';
@@ -150,7 +155,11 @@ Offer DAV or SSH access.");
foreach ($repo_list as $repo_name) {
// Warning : the ssh uri MUST be this
form : ssh://username@scmbox//path/reponame
// HAVE YOU SEEN THE //
starting the path ? Keep in mind the double /
- $htmlRepo .= html_e('kbd', array(), 'hg
clone ssh://'.html_e('i', array(), _('developername'), true,
false).'@'.$this->getBoxForProject($project).$ssh_port.'/'.forge_get_config('repos_path',
'scmhg').'/'.$project->getUnixName()).html_e('br');
+ if
(forge_get_config('use_shell_limited') {
+ $htmlRepo .= html_e('kbd',
array(), 'hg clone ssh://'.html_e('i', array(), _('developername'), true,
false).'@'.$this->getBoxForProject($project).$ssh_port.'/hg/'.$project->getUnixName()).html_e('br');
+ } else {
+ $htmlRepo .= html_e('kbd',
array(), 'hg clone ssh://'.html_e('i', array(), _('developername'), true,
false).'@'.$this->getBoxForProject($project).$ssh_port.'/'.forge_get_config('repos_path',
'scmhg').'/'.$project->getUnixName()).html_e('br');
+ }
}
$b .= html_e('p', array(), $htmlRepo);
$b .= '</div>';
https://scm.fusionforge.org/anonscm/gitweb/?p=fusionforge/fusionforge.git;a=commitdiff;h=306ed594181fdc7e72bcd91975482058adb5b748
commit 306ed594181fdc7e72bcd91975482058adb5b748
Author: Franck Villaume <[email protected]>
Date: Sat Jan 20 10:21:07 2018 +0100
forge_get_config: fix example command
diff --git a/src/bin/forge_get_config b/src/bin/forge_get_config
index 609e5cc..4e99a23 100755
--- a/src/bin/forge_get_config
+++ b/src/bin/forge_get_config
@@ -67,7 +67,7 @@ if (count ($argv) == 3) {
} else {
echo "Usage: .../forge-get-config <variable> [ <section> ]
For instance: .../forge-get-config web_host
- .../forge-get-config repo_prefix scmsvn
+ .../forge-get-config repos_path scmsvn
Or: .../forge-get-config list-all-variables, for all variables
.../forge-get-config list-all-variables-values, for all
variables and their values
-----------------------------------------------------------------------
Summary of changes:
src/GNUmakefile | 3 +-
src/bin/forge_get_config | 2 +-
src/bin/limited_ssh.sh | 109 ++++++++++++++++++++++++++++
src/common/include/User.class.php | 3 +
src/etc/config.ini.d/defaults.ini | 1 +
src/plugins/scmhg/common/HgPlugin.class.php | 13 +++-
6 files changed, 127 insertions(+), 4 deletions(-)
create mode 100644 src/bin/limited_ssh.sh
hooks/post-receive
--
FusionForge
_______________________________________________
Fusionforge-commits mailing list
[email protected]
http://lists.fusionforge.org/cgi-bin/mailman/listinfo/fusionforge-commits
