All of lore.kernel.org
 help / color / mirror / Atom feed
From: Erik Broes <erikbroes@ripe.net>
To: git@vger.kernel.org
Subject: [PATCH] git-shell: Add 'git-upload-archive' to allowed commands.
Date: Thu, 09 Apr 2009 21:58:52 +0200	[thread overview]
Message-ID: <49DE537C.8070907@ripe.net> (raw)

This allows for example gitosis to allow use of 'git archive --remote' in a
controlled environment.

Signed-off-by: Erik Broes <erikbroes@ripe.net>
---

There were some questions on IRC raising (valid) concerns about security.
If there is a dangling commit on the remote end and any user would know
or guess the SHA, it could be retrieved where git-upload-pack will not
allow so.

We were unable to find out if this was the original reason git-shell was
never extended with git-upload-archive functionality or if it was a simple
oversight. If it was the reason I'm not sure there is an easy way out.

 Documentation/git-shell.txt |    6 +++---
 shell.c                     |    1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/Documentation/git-shell.txt b/Documentation/git-shell.txt
index 3f8d973..0f3ad81 100644
--- a/Documentation/git-shell.txt
+++ b/Documentation/git-shell.txt
@@ -18,9 +18,9 @@ of server-side GIT commands implementing the pull/push functionality.
 The commands can be executed only by the '-c' option; the shell is not
 interactive.

-Currently, only three commands are permitted to be called, 'git-receive-pack'
-'git-upload-pack' with a single required argument or 'cvs server' (to invoke
-'git-cvsserver').
+Currently, only four commands are permitted to be called, 'git-receive-pack'
+'git-upload-pack' and 'git-upload-archive' with a single required argument, or
+'cvs server' (to invoke 'git-cvsserver').

 Author
 ------
diff --git a/shell.c b/shell.c
index e339369..b968be7 100644
--- a/shell.c
+++ b/shell.c
@@ -40,6 +40,7 @@ static struct commands {
 } cmd_list[] = {
 	{ "git-receive-pack", do_generic_cmd },
 	{ "git-upload-pack", do_generic_cmd },
+	{ "git-upload-archive", do_generic_cmd },
 	{ "cvs", do_cvs_cmd },
 	{ NULL },
 };
-- 
1.6.2.1.519.gcf01bc

             reply	other threads:[~2009-04-09 22:24 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-04-09 19:58 Erik Broes [this message]
2009-04-11 19:22 ` [PATCH] git-shell: Add 'git-upload-archive' to allowed commands Junio C Hamano
2009-04-12 14:07   ` Erik Broes
2009-04-14  6:09   ` Björn Steinbrink

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=49DE537C.8070907@ripe.net \
    --to=erikbroes@ripe.net \
    --cc=git@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.