Redmine

=head1 GIT SMART HTTP SUPPORT

Git's smart HTTP protocol will not work with the above settings. Redmine.pm

normally does access control depending on the HTTP method used: read-only

methods are OK for everyone in public projects and members with read rights

in private projects. The rest require membership with commit rights in the

project.

However, this scheme doesn't work for Git's smart HTTP protocol, as it will use

POST even for a simple clone. Instead, read-only requests must be detected

using the full URL (including the query string): anything that doesn't belong

to the git-receive-pack service is read-only.

To activate this mode of operation, add this line inside your <Location /git>

block:

  RedmineGitSmartHttp yes

Here's a sample Apache configuration which integrates git-http-backend with

a MySQL database and this new option. Please make sure that your Location path

does not have a trailing slash, as in this example, or it won't work:

   SetEnv GIT_PROJECT_ROOT /var/www/git/

   SetEnv GIT_HTTP_EXPORT_ALL

   ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/

   <Location /git>

       Order allow,deny

       Allow from all

       AuthType Basic

       AuthName Git

       Require valid-user

       PerlAccessHandler Apache::Authn::Redmine::access_handler

       PerlAuthenHandler Apache::Authn::Redmine::authen_handler

       # for mysql

       RedmineDSN "DBI:mysql:database=redmine;host=127.0.0.1"

       RedmineDbUser "redmine"

       RedmineDbPass "xxx"

       RedmineGitSmartHttp yes

    </Location>

Make sure that all the names of the repositories under /var/www/git/ match

exactly the identifier for some project: /var/www/git/myproject.git won't work,

due to the way this module extracts the identifier from the URL.

/var/www/git/myproject will work, though. You can put both bare and non-bare

repositories in /var/www/git.

Once you have activated this option, you have two options when cloning a

repository. Cloning using "http://user@host/git/repo" works, but will ask for

the password all the time. To avoid being pestered by password requests, it's

best to create a ~/.netrc file with your username and password, and clone using

"http://host/git/repo" instead.

IMPORTANT NOTE: It is *very important* that the file cannot be read by other

users, as it will contain your password in cleartext. To create the file, you

can use the following commands, replacing yourhost, youruser and yourpassword

with the right values:

  touch ~/.netrc

  chmod 600 .netrc

  echo -e "machine yourhost\nlogin youruser\npassword yourpassword" > ~/.netrc

  {

    name => 'RedmineGitSmartHttp',

    req_override => OR_AUTHCFG,

    args_how => TAKE1,

  },

sub RedmineGitSmartHttp {

  my ($self, $parms, $arg) = @_;

  $arg = lc $arg;

  if ($arg eq "yes" || $arg eq "true") {

    $self->{RedmineGitSmartHttp} = 1;

  } else {

    $self->{RedmineGitSmartHttp} = 0;

  }

}

sub request_is_read_only {

  my ($r) = @_;

  my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);

  # Do we use Git's smart HTTP protocol, or not?

  if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp}) {

    my $uri = $r->unparsed_uri;

    my $location = $r->location;

    my $is_read_only = $uri !~ m{^$location/.*/[^/]*git\-receive\-pack$}o;

    return $is_read_only;

  } else {

    # Old behaviour: check the HTTP method

    my $method = $r->method;

    return defined $read_only_methods{$method};

  }

}

  return OK unless request_is_read_only($r);

          if ($hashed_password eq $pass_digest && ((request_is_read_only($r) && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {

            $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass)

			 && ((request_is_read_only($r) && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));