BUG in http-backend.c http.receivepack

[Springer, Stephan]

Hello Guys,

I found bug in http-backend.c with config-flag http.receivepack  You describe 
in our documentation: This serves git send-pack clients, allowing push. It is 
disabled by default for anonymous users, and enabled by default for users 
authenticated by the web server. It can be disabled by setting this item to 
false, or enabled for all users, including anonymous users, by setting it to 
true.
That cannot work, while svc-enable less than 0. See attachment 

I tested with Centos 6.x,  Nginx 1.0.15 and Git 2.2.0-rc3 and Git 2.1.3

I hope you understand me and I don´t talk nonsense. My English a little rusty 
and this is my first bug report for open source project :-)  

Best regards
Stephan Springer
__

SLOMAN NEPTUN Schiffahrts-Aktiengesellschaft
Langenstr. 44, 28195 Bremen / Germany
Telephone: ++49 (0) 421 1763 - 291
Telefax:   ++49 (0) 421 1763 - 400
E-Mail: sprin...@sloman-neptun.com
Page: www.sloman-neptun.com

Registergericht/Registered office: Amtsgericht Bremen (HRB 4046)
Vorsitzender des Aufsichtsrats/Chairman of the Supervisory Board: Fritz 
Lütke-Uhlenbrock
Vorstand / Board of Managing Directors: Sven-Michael Edye, Dirk Lohmann  
__

https://github.com/git/git/blob/master/http-backend.c

static void http_config(void)
{
int i, value = 0;
struct strbuf var = STRBUF_INIT;

git_config_get_bool(http.getanyfile, getanyfile);

for (i = 0; i  ARRAY_SIZE(rpc_service); i++) {
   struct rpc_service *svc = rpc_service[i];
   strbuf_addf(var, http.%s, svc-config_name);
   if (!git_config_get_bool(var.buf, value))
   svc-enabled = value;   1 or 0 
   strbuf_reset(var);
}

strbuf_release(var);
}

static struct rpc_service *select_service(const char *name)
{
const char *svc_name;
struct rpc_service *svc = NULL;
int i;

if (!skip_prefix(name, git-, svc_name))
   forbidden(Unsupported service: '%s', name);

for (i = 0; i  ARRAY_SIZE(rpc_service); i++) {
   struct rpc_service *s = rpc_service[i];
   if (!strcmp(s-name, svc_name)) {
   svc = s;
   break;
   }
}

if (!svc)
   forbidden(Unsupported service: '%s', name);

#
# better (svc-enabled = 0) than can “REMOTE_USER” enable push 
function 
#
if (svc-enabled  0) {
   const char *user = getenv(REMOTE_USER);
   svc-enabled = (user  *user) ? 1 : 0;
}
if (!svc-enabled)
   forbidden(Service not enabled: '%s', svc-name);
return svc;
}

Re: BUG in http-backend.c http.receivepack

[Jeff King]

On Mon, Nov 24, 2014 at 09:18:52AM +0100, Springer, Stephan wrote:

 I found bug in http-backend.c with config-flag http.receivepack  You
 describe in our documentation: This serves git send-pack clients,
 allowing push. It is disabled by default for anonymous users, and
 enabled by default for users authenticated by the web server. It can
 be disabled by setting this item to false, or enabled for all users,
 including anonymous users, by setting it to true.
 That cannot work, while svc-enable less than 0. See attachment

Sorry, I don't quite understand. The enabled field is one of:

  -1: we allow access if $REMOTE_USER is set, and otherwise not
   0: we never allow access
   1: we always allow access

The default is -1. By setting it to true or false you get 1 or 0,
respectively. You cannot explicitly ask for the default, except by not
setting the value in the first place.

 #
 # better (svc-enabled = 0) than can ?REMOTE_USER? enable push 
 function 
 #
 if (svc-enabled  0) {
const char *user = getenv(REMOTE_USER);
svc-enabled = (user  *user) ? 1 : 0;
 }

If this condition were svc-enabled = 0, then setting the config
option to false, which should turn off access, will respect
$REMOTE_USER instead. That is not right.

Can you describe what you're configuring and running, what behavior you
expect, and what you get instead?

-Peff
--
To unsubscribe from this list: send the line unsubscribe git in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html