Christian Couder
4289680334
Previous commits created and prepared the path_allowlist_apply()
and path_allowlist_config_apply() functions, but used them only for the
"safe.directory" configuration variable.
Let's reuse these functions for a new "uploadpack.lazyFetchTrusted"
configuration variable.
It allows us to:
- read an allowlist from that config variable,
- check if the current repo is in that list, and
- return the result from a new upload_pack_lazy_fetch_trusted()
function.
As path_allowlist_config_apply() lets each caller decide which paths
it is willing to accept using a callback, let's pass it a new
allow_trusted_path() callback. Unlike the "safe.directory" callback, it
accepts only absolute paths, and not ".", as `upload-pack` always
serves a repository given by an absolute path, so there is no "current
repository" for "." to refer to.
Note that a served repository is identified by its git directory, and
not by its worktree. This is because `upload-pack` uses enter_repo()
instead of the usual repository discovery, so it never learns about a
worktree and `r->worktree` is always NULL there. In practice this
means that a non-bare repository served as "/srv/repo" has to be
allowlisted as "/srv/repo/.git" (or as the directory its ".git" file
points to, if it has a ".git" file instead of a ".git" directory).
The new upload_pack_lazy_fetch_trusted() function will be used in a
following commit.
Note that the new config variable should be read only from protected
configuration files.
Signed-off-by: Christian Couder <christian.couder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
19 lines
477 B
C
19 lines
477 B
C
#ifndef UPLOAD_PACK_H
|
|
#define UPLOAD_PACK_H
|
|
|
|
void upload_pack(const int advertise_refs, const int stateless_rpc,
|
|
const int timeout);
|
|
|
|
struct repository;
|
|
struct packet_reader;
|
|
int upload_pack_v2(struct repository *r, struct packet_reader *request);
|
|
|
|
struct strbuf;
|
|
int upload_pack_advertise(struct repository *r,
|
|
struct strbuf *value);
|
|
|
|
/* Is this repo trusted for lazy fetching? */
|
|
bool upload_pack_lazy_fetch_trusted(struct repository *r);
|
|
|
|
#endif /* UPLOAD_PACK_H */
|