Redmine

=head1 GIT SMART HTTP SUPPORT

Git's smart HTTP protocol (available since Git 1.7.0) will not work with the

above settings. Redmine.pm normally does access control depending on the HTTP

method used: read-only methods are OK for everyone in public projects and

members with read rights in private projects. The rest require membership with

commit rights in the project.

However, this scheme doesn't work for Git's smart HTTP protocol, as it will use

POST even for a simple clone. Instead, read-only requests must be detected using

the full URL (including the query string): anything that doesn't belong to the

git-receive-pack service is read-only.

To activate this mode of operation, add this line inside your <Location /git>

block:

  RedmineGitSmartHttp yes

Here's a sample Apache configuration which integrates git-http-backend with

a MySQL database and this new option:

   SetEnv GIT_PROJECT_ROOT /var/www/git/

   SetEnv GIT_HTTP_EXPORT_ALL

   ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/

   <Location /git>

       Order allow,deny

       Allow from all

       AuthType Basic

       AuthName Git

       Require valid-user

       PerlAccessHandler Apache::Authn::Redmine::access_handler

       PerlAuthenHandler Apache::Authn::Redmine::authen_handler

       # for mysql

       RedmineDSN "DBI:mysql:database=redmine;host=127.0.0.1"

       RedmineDbUser "redmine"

       RedmineDbPass "xxx"

       RedmineGitSmartHttp yes

    </Location>

Make sure that all the names of the repositories under /var/www/git/ have a

matching identifier for some project: /var/www/git/myproject and

/var/www/git/myproject.git will work. You can put both bare and non-bare

repositories in /var/www/git, though bare repositories are strongly

recommended. You should create them with the rights of the user running Redmine,

like this:

  cd /var/www/git

  sudo -u user-running-redmine mkdir myproject

  cd myproject

  sudo -u user-running-redmine git init --bare

Once you have activated this option, you have three options when cloning a

repository:

- Cloning using "http://user@host/git/repo(.git)" works, but will ask for the password

  all the time.

- Cloning with "http://user:pass@host/git/repo(.git)" does not have this problem, but

  this could reveal accidentally your password to the console in some versions

  of Git, and you would have to ensure that .git/config is not readable except

  by the owner for each of your projects.

- Use "http://host/git/repo(.git)", and store your credentials in the ~/.netrc

  file. This is the recommended solution, as you only have one file to protect

  and passwords will not be leaked accidentally to the console.

  IMPORTANT NOTE: It is *very important* that the file cannot be read by other

  users, as it will contain your password in cleartext. To create the file, you

  can use the following commands, replacing yourhost, youruser and yourpassword

  with the right values:

    touch ~/.netrc

    chmod 600 ~/.netrc

    echo -e "machine yourhost\nlogin youruser\npassword yourpassword" > ~/.netrc

  {

    name => 'RedmineGitSmartHttp',

    req_override => OR_AUTHCFG,

    args_how => TAKE1,

  },

sub RedmineGitSmartHttp {

  my ($self, $parms, $arg) = @_;

  $arg = lc $arg;

  if ($arg eq "yes" || $arg eq "true") {

    $self->{RedmineGitSmartHttp} = 1;

  } else {

    $self->{RedmineGitSmartHttp} = 0;

  }

}

sub request_is_read_only {

  my ($r) = @_;

  my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);

  # Do we use Git's smart HTTP protocol, or not?

  if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp}) {

    my $uri = $r->unparsed_uri;

    my $location = $r->location;

    my $is_read_only = $uri !~ m{^$location/*[^/]+/+(info/refs\?service=)?git\-receive\-pack$}o;

    return $is_read_only;

  } else {

    # Standard behaviour: check the HTTP method

    my $method = $r->method;

    return defined $read_only_methods{$method};

  }

}

  return OK unless request_is_read_only($r);

  my $access_mode = request_is_read_only($r) ? "R" : "W";

    my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);

    $location =~ s/\.git$// if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp});

# Redmine - project management software

# Copyright (C) 2006-2012  Jean-Philippe Lang

#

# This program is free software; you can redistribute it and/or

# modify it under the terms of the GNU General Public License

# as published by the Free Software Foundation; either version 2

# of the License, or (at your option) any later version.

#

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

# GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with this program; if not, write to the Free Software

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.

require File.expand_path('../test_case', __FILE__)

require 'tmpdir'

class RedminePmTest::RepositoryGitTest < RedminePmTest::TestCase

  fixtures :projects, :users, :members, :roles, :member_roles

  GIT_BIN = Redmine::Configuration['scm_git_command'] || "git"

  def test_anonymous_read_on_public_repo_with_permission_should_succeed

    assert_success "ls-remote", git_url

  end

  def test_anonymous_read_on_public_repo_without_permission_should_fail

    Role.anonymous.remove_permission! :browse_repository

    assert_failure "ls-remote", git_url

  end

  def test_invalid_credentials_should_fail

    Project.find(1).update_attribute :is_public, false

    with_credentials "dlopper", "foo" do

      assert_success "ls-remote", git_url

    end

    with_credentials "dlopper", "wrong" do

      assert_failure "ls-remote", git_url

    end

  end

  def test_clone

    Dir.mktmpdir do |dir|

      Dir.chdir(dir) do

        assert_success "clone", git_url

      end

    end

  end

  def test_write_commands

    Role.find(2).add_permission! :commit_access

    filename = random_filename

    Dir.mktmpdir do |dir|

      assert_success "clone", git_url, dir

      Dir.chdir(dir) do

        f = File.new(File.join(dir, filename), "w")

        f.write "test file content"

        f.close

        with_credentials "dlopper", "foo" do

          assert_success "add", filename

          assert_success "commit -a --message Committing_a_file"

          assert_success "push", git_url, "--all"

        end

      end

    end

    Dir.mktmpdir do |dir|

      assert_success "clone", git_url, dir

      Dir.chdir(dir) do

        assert File.exists?(File.join(dir, "#{filename}"))

      end

    end

  end

  protected

  def execute(*args)

    a = [GIT_BIN]

    super a, *args

  end

  def git_url(path=nil)

    host = ENV['REDMINE_TEST_DAV_SERVER'] || '127.0.0.1'

    credentials = nil

    if username && password

      credentials = "#{username}:#{password}"

    end

    url = "http://#{credentials}@#{host}/git/ecookbook"

    url << "/#{path}" if path

    url

  end

end