From: Ivan Kanis <ivan.kanis@googlemail.com>
To: Junio C Hamano <gitster@pobox.com>
Cc: Shawn Pearce <spearce@spearce.org>,
Git Mailing List <git@vger.kernel.org>
Subject: Re: security flaw with smart http
Date: Thu, 28 Jun 2012 09:35:23 +0200 [thread overview]
Message-ID: <87obo3j3d0.fsf@visionobjects.com> (raw)
In-Reply-To: <7vmx3vp2co.fsf@alter.siamese.dyndns.org> (Junio C. Hamano's message of "Fri, 22 Jun 2012 12:34:47 -0700")
Junio C Hamano <gitster@pobox.com> a écrit
> Shawn Pearce <spearce@spearce.org> writes:
>
>> On Fri, Jun 22, 2012 at 3:12 AM, Ivan Kanis <ivan.kanis@googlemail.com> wrote:
>>> I think we found a security flaw with git http smart backend. We are
>>> running git version 1.0.7.4 on our server. Adding random words after the
>>> password and the authentication still succeeds.
>>
>> git http-backend does not handle authentication or authorization. This
>> is handled in your web server. You should consult your web server's
>> documentation, and maybe its configuration files.
>
> Very good advice.
In case someone is reading this thread I confirm the problem comes from
Apache.
--
Ivan Kanis, Release Manager, Vision Objects,
Le mal est un mulet : il est opiniâtre et stérile.
-- Victor Hugo
prev parent reply other threads:[~2012-06-28 7:35 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-06-22 10:12 security flaw with smart http Ivan Kanis
2012-06-22 17:54 ` Shawn Pearce
2012-06-22 19:34 ` Junio C Hamano
2012-06-25 11:24 ` Philippe Vaucher
2012-06-25 12:59 ` Ivan Kanis
2012-06-25 13:10 ` Erik Faye-Lund
2012-06-28 7:35 ` Ivan Kanis [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87obo3j3d0.fsf@visionobjects.com \
--to=ivan.kanis@googlemail.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=spearce@spearce.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.