git-cvsserver: use a password file cvsserver pserver
If a git repository is shared via HTTP, the config file is typically visible. Use an external file instead. Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Sam Vilain committed
May 15, 2010 at 15:07 UTC
c057bad3701682a208b72473b746de6bb5d89792
2 files changed
+31
-19
Documentation/git-cvsserver.txt
+16
-5
@@ -100,16 +100,27 @@ looks like
100
------
101
102
Only anonymous access is provided by pserve by default. To commit you
103
-will have to create pserver accounts, simply add a [gitcvs.users]
104
-section to the repositories you want to access, for example:
103
+will have to create pserver accounts, simply add a gitcvs.authdb
104
+setting in the config file of the repositories you want the cvsserver
105
+to allow writes to, for example:
106
107
------
108
108
- [gitcvs.users]
109
- someuser = somepassword
110
- otheruser = otherpassword
109
+ [gitcvs]
110
+ authdb = /etc/cvsserver/passwd
111
+
112
+------
113
+The format of these files is username followed by the crypted password,
114
+for example:
115
116
------
117
+ myuser:$1Oyx5r9mdGZ2
118
+ myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./
119
+------
120
+You can use the 'htpasswd' facility that comes with Apache to make these
121
+files, but Apache's MD5 crypt method differs from the one used by most C
122
+library's crypt() function, so don't use the -m option.
123
+
124
Then provide your password via the pserver method, for example:
125
------
126
cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>
git-cvsserver.perl
+15
-14
@@ -189,24 +189,25 @@ if ($state->{method} eq 'pserver') {
189
190
unless ($user eq 'anonymous') {
191
# Trying to authenticate a user
192
- if (not exists $cfg->{gitcvs}->{users}) {
193
- print "E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\n";
192
+ if (not exists $cfg->{gitcvs}->{authdb}) {
193
+ print "E the repo config file needs a [gitcvs.authdb] section with a filename\n";
194
print "I HATE YOU\n";
195
exit 1;
196
- } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {
197
- #print "E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\n";
196
+ }
197
+ my $auth_ok;
198
+ open PASSWD, "<$cfg->{gitcvs}->{authdb}" or die $!;
199
+ while(<PASSWD>) {
200
+ if (m{^\Q$user\E:(.*)}) {
201
+ if (crypt($user, $1) eq $1) {
202
+ $auth_ok = 1;
203
+ }
204
+ };
205
+ }
206
+ unless ($auth_ok) {
207
print "I HATE YOU\n";
208
exit 1;
200
- } else {
201
- my $descrambled_password = descramble($password);
202
- my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};
203
- if ($descrambled_password ne $cleartext_password) {
204
- #print "E The password supplied for user $user was incorrect\n";
205
- print "I HATE YOU\n";
206
- exit 1;
207
- }
208
- # else fall through to LOVE
209
}
210
+ # else fall through to LOVE
211
}
212
213
# For checking whether the user is anonymous on commit
@@ -337,7 +338,7 @@ sub req_Root
338
}
339
foreach my $line ( @gitvars )
340
{
340
- next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver|users)\.)?([\w-]+)=(.*)$/ );
341
+ next unless ( $line =~ /^(gitcvs)\.(?:(ext|pserver)\.)?([\w-]+)=(.*)$/ );
342
unless ($2) {
343
$cfg->{$1}{$3} = $4;
344
} else {