Redmine

  #by heagdl, added 2 error msgs

  def render_ad(options={})

    render_error({:message => "Access to this repository denied! Please contact your system administrator for further information.", :status => 401}.merge(options))

    return false

  end 

  def render_rd(options={})

    render_error({:message => "Access to this revision denied! You are not authorized to see the associated paths. Please contact your system administrator for further information.", :status => 401}.merge(options))

    return false

  end 

require 'open3' #may be unused

require 'svncheck'

  before_filter :check_repo_access, :only => [:revision, :revisions, :show, :changes, :diff, :graph, :stats, :entry, :annotate, :raw]

  #check if the current user is allowed to access the repository at the requested paths

  def check_repo_access

    if (@repository.type.eql? "Repository::Subversion")

      begin

        @svnchk = SVNCheck.new(@repository.url,@repository.root_url,User.current.login)

        if params[:action] == "revision" 

          if !@svnchk.chkrev(@changeset.id)

            render_rd; return false

          end 

        else 

          if params[:path].nil?

            reqpath = "/" 

          else

            reqpath = "/"+params[:path]

          end 

          logger.info 'SVN-Request for following path: ' + reqpath

          if !(@svnchk.chkurl(reqpath))

            render_ad; return false

          end 

        end 

      rescue Exception => e

        logger.fatal "An error occured during svnchk!"

        logger.info e.message

      end 

    end 

  end 

                             :title => if (repository.type.eql? "Repository::Subversion")

                                         require 'svncheck'

                                         svnc = SVNCheck.new(repository.url,repository.root_url,User.current.login)

                                         if !svnc.chkrev(changeset.id)

                                           "Access to this revision denied!"

                                         else 

                                           truncate_single_line_raw(changeset.comments, 100) 

                                         end  

                                       else 

                                         truncate_single_line_raw(changeset.comments, 100) 

                                       end) 

    #check if allowed to show by haegdl:

    if (repository.type.eql? "Repository::Subversion")

      require 'svncheck'

      svnc = SVNCheck.new(repository.url,repository.root_url,User.current.login)

      if !svnc.chkrev(id)

        @short_comments = "Access to this revision denied!"

        @long_comments = "You have no rights to access this path in your svn repository!"

      end 

    end 

#################################################

# INFO 

#

# This file was written by Daniel Haeger (haegdl@idmt.fraunhofer.de)

# Its a helper for checking if a user is permitted to access a SVN

# repository protected by mod_authz_svn with path-based authz.

#

# In the same directory, a 'right to read' dominates a 'deny'

# For initialisation, the paths to the authz file of the repo

# and the user have to be specified! 

#

# root_url is different that url if the svn should just

# access a subdir!

#

# TODO

# 

# -wrap it in begin.rescue.end blocks

# -allow aliases

# -logging instead of puts using STDERR.puts "error" ?

#

# Last edited: 13.10.14 13:37

#

##################################################

class SVNCheck

  def initialize(url, rooturl, user)

    puts "Started SVNCheck with:\n " + url + "\n " + rooturl + "\n " + user

    status = 0

    currentpath = ""

    @user = user.dup 

    @authzpath = rooturl.dup #"/opt/svn/systies_cp/conf/authz"

    if @authzpath.start_with?("file://")

      @authzpath.slice!("file://") #remove beginning (we need absolut path)

    end

    @authzpath = @authzpath.chomp("/") + "/conf/authz"

    usergroups = [] #all groups the user is in, groups have to be specified before beeing used

    @ap = [] #paths with allowed access

    @dp = [] #paths with denied access

    #set prefix path

    @urlprefix = "" #if repository is a svn subdirectory, we need a prefix to match paths from authz file 

    #catch if rooturl.nil? (when repo is just created!) Add/Change your name below to be able to browse the svn for the first time!!!!

    if ((rooturl.size == 0) && !(user.eql?("haegdl") || user.eql?("admin")))

      puts "ERROR during SVNCheck, rooturl is nil, please access the repo from admin/haegdl account to activate it!"

    else

      #set prefix if needed

      if url.length > rooturl.length

        @urlprefix = url.sub(rooturl, "")

      end 

      File.open(@authzpath, "r") do |f|

        f.each_line do |line|

          line.gsub!(/\s+/, "") #.downcase! removes whitespace; lowercasing disabled!

          if !(line.empty? || (line[0,1] == "#") || (line[0,9] == "[aliases]")) #comments or empty lines shall not be processed

            nchanged = true  #not changed; used to ignore section lines    

            #section check 

            if line[0,8] == '[groups]' then 

              status = 1	#1=> group declaration 

              nchanged = false

            elsif line[0,2] == '[/' then

              status = 2 # path check mode

              nchanged = false

            end

            #PLACE FOR STRING OPERATION

            case status

            when 1		#check for groups

              parts = line.split("=")

              if ( !(parts.empty?) && (parts.size == 2) && nchanged)

                if parts[1].split(",").include? user  

                  usergroups << "@" + parts[0]

                else

                  #allow groups in group creation

                  parts[1].split(",") do |x|

                    if usergroups.include? x

                      usergroups << parts[0]

                      break

                    end

                  end

                end    

              end

            when 2

              if !(nchanged)

                #this line specifies path

                currentpath = line.gsub!(/[\[\]]/, "")

              else

                #3 checks: first: groups_allowed?; second: userallowed

                parts = line.split("=")

    	        if (!(parts.empty?) && (parts.size == 2)) 

  	          #check groups

                  if (usergroups.include? parts[0]) 	#name matches a group name the user is in

                    case parts[1]

                    when "rw", "wr", "r"

                      @ap << currentpath

                    when "w"

                      puts "NOTE: just write-access, doing nothing!"

                    else

                      puts "ERROR, 2nd part could not be interpreted" + parts[1]

                    end

                  end

                  #check explicit mentioned user

                  if (parts[0].eql? user)  #if username is mentiend

                    case parts[1]

                    when "rw", "wr", "r"

                      @ap << currentpath

                    when "w"

                      puts "NOTE: just write-access, not implemented yet, doing nothing!"

                    else

                      puts "ERROR, 2nd Part could not be interpreited" + "###" + parts[1] + "###"

                    end

                  end

                #*= all user

  	        if (parts[0].eql? "*")

                    case parts[1]

                    when "rw", "wr", "r"

                      @ap << currentpath 

                    when "w"

                      puts "ERROR, not implemented yet!"

                    else 

                      puts "ERROR, second part could not be interpreted"

                    end

                  end

                end

                #interpret denied access

                if (parts.size == 1)

                  if ((parts[0].eql? user)|| (usergroups.include? parts[0]) || (parts[0].eql? "*") )

                    @dp << currentpath

                  end

                end

              end                 

            else

              puts "ERROR!"

            end   

          end 

        end

      end

    end

  end

  # Erklaerung:

  # 

  # Suche alle Pfade für die Richtlinien existieren, welche ein Teil des zu ueberpruefenden Pfades

  # sind und gleichzeitig fuer den Benutzer gelten (andere werden ignoriert!)

  # Bestimme den laengsten uebereinstimmenden Pfad fuer den es eine Regel gibt und wende sie an.

  def chk(chkurl)

    chkp =  chkurl#.sub("/","") # @urlprefix + ...

    puts "PATH TO CHECK: " + chkp + " PREFIX IS: " + @urlprefix

    ap = @ap.dup

    dp = @dp.dup

    #remove tailing '/'

    (ap + dp).each do |s|

      if s.length > 1 

        s.chomp!("/")

      end

    end

    if chkp.length > 1

      chkp.chomp!("/")

    end 

    #just keep paths matching to the path we have to check

    dp.delete_if { |x| !dirorsubdir(chkp,x) } 

    ap.delete_if { |x| !dirorsubdir(chkp,x) } 

    puts "Authz rules found for following paths:"

    puts (ap + dp)

    path = (ap + dp).sort_by(&:length).reverse.first

    puts "Winner Path = " + path unless path.nil?

    if (path.nil? || path.eql?(""))

      puts "ACCESS DENIED! Checked path: " + chkp + " There is no rule for this person in the conf file!"

      return false

    else

      if ap.include?(path)

        #access granted!

        puts "ACCESS GRANTED! Checked path: " + chkp + " Allowed by read-rule in: "+ path

        return true

      end

      if dp.include?(path)

        #access denied!

        puts "ACCESS DENIED! Checked path: " + chkp + " Denied by rule in: " + path

        return false

      end

    end

  end

  def dirorsubdir(chkp, x)

    if chkp.start_with?(x)

      if ((chkp.length > x.length) && (chkp[x.length,1] == "/" ))

        #chkp is in directory x or one of its subdirs (recursiv)

        return true

      elsif chkp == x

        # path that was asked for

        return true

      elsif x == "/"

        #is always valid (check if other paths match better is solved by sorting in chk

        return true

      else

        #deny all other

        return false

      end

    else

      return false

    end

  end

  #resolve revisions to paths

  def chkrev(csetid)

    puts 'SVN-Request for Revision: ' + Changeset.find(csetid).revision

    changes = Change.where(changeset_id: csetid)  

    changes.each do |x|

      if !(chk(x.path)) 

        puts 'SVN-Request DENIED for ' + User.current.login

        return false

      end

    end

    #didnt returned false before -> no request denied

    puts 'SVN-Request ALLOWED for ' + User.current.login

    return true

  end

  def chkurl(url)

    #add prefix if svn-subdir (not needed @revisions)

    return chk(@urlprefix.chomp("/") + url)

  end

end