gitweb: Add a per-repository authorization hook.
Add a configuration variable that can be used to specify an arbitrary subroutine that will be called in the same situations where $export_ok is checked, and its return value used to decide whether the repository is to be shown. This allows the user to implement custom authentication schemes, for example by issuing a subrequest through mod_perl and checking if Apache will authorize it. Signed-off-by: Alexander Gavrilov <angavrilov@gmail.com> Acked-by: Jakub Narebski <jnareb@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Alexander Gavrilov committed
Nov 6, 2008 at 01:36 UTC
dd7f5f105a1d4d094a96c5e3f251854f81106be0
2 files changed
+28
-1
gitweb/INSTALL
+21
@@ -166,6 +166,27 @@ Gitweb repositories
166
shows repositories only if this file exists in its object database
167
(if directory has the magic file named $export_ok).
168
169
+- Finally, it is possible to specify an arbitrary perl subroutine that
170
+ will be called for each project to determine if it can be exported.
171
+ The subroutine receives an absolute path to the project as its only
172
+ parameter.
173
+
174
+ For example, if you use mod_perl to run the script, and have dumb
175
+ http protocol authentication configured for your repositories, you
176
+ can use the following hook to allow access only if the user is
177
+ authorized to read the files:
178
+
179
+ $export_auth_hook = sub {
180
+ use Apache2::SubRequest ();
181
+ use Apache2::Const -compile => qw(HTTP_OK);
182
+ my $path = "$_[0]/HEAD";
183
+ my $r = Apache2::RequestUtil->request;
184
+ my $sub = $r->lookup_file($path);
185
+ return $sub->filename eq $path
186
+ && $sub->status == Apache2::Const::HTTP_OK;
187
+ };
188
+
189
+
190
Generating projects list using gitweb
191
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
192
gitweb/gitweb.perl
+7
-1
@@ -95,6 +95,11 @@ our $default_projects_order = "project";
95
# (only effective if this variable evaluates to true)
96
our $export_ok = "++GITWEB_EXPORT_OK++";
97
98
+# show repository only if this subroutine returns true
99
+# when given the path to the project, for example:
100
+# sub { return -e "$_[0]/git-daemon-export-ok"; }
101
+our $export_auth_hook = undef;
102
+
103
# only allow viewing of repositories also shown on the overview page
104
our $strict_export = "++GITWEB_STRICT_EXPORT++";
105
@@ -400,7 +405,8 @@ sub check_head_link {
405
sub check_export_ok {
406
my ($dir) = @_;
407
return (check_head_link($dir) &&
403
- (!$export_ok || -e "$dir/$export_ok"));
408
+ (!$export_ok || -e "$dir/$export_ok") &&
409
+ (!$export_auth_hook || $export_auth_hook->($dir)));
410
}
411
412
# process alternate names for backward compatibility