revi-archive/phorge-phorge
1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2025-02-22 19:49:02 +01:00
Code Issues Releases Wiki Activity

Don't throw when user tries to use an empty password via HTTP auth

Browse source 
Summary: Fixes T4064. See discussion there.

Test Plan: Tried `git clone http://...` with empty password, got 403. Retried with actual password, got a clone.

Reviewers: jamesr, btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T4064

Differential Revision: https://secure.phabricator.com/D7508
This commit is contained in:
epriestley 2013-11-05 15:24:58 -08:00
parent e4569e7e7e
commit ce48375951
1 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/applications/diffusion/controller/DiffusionController.php
View file

@ -8,6 +8,8 @@ abstract class DiffusionController extends PhabricatorController {
$request = $this->getRequest(); $request = $this->getRequest();
$uri = $request->getRequestURI(); $uri = $request->getRequestURI();
$user_agent = idx($_SERVER, 'HTTP_USER_AGENT');
// Check if this is a VCS request, e.g. from "git clone", "hg clone", or // Check if this is a VCS request, e.g. from "git clone", "hg clone", or
// "svn checkout". If it is, we jump off into repository serving code to // "svn checkout". If it is, we jump off into repository serving code to
// process the request. // process the request.
@ -27,6 +29,8 @@ abstract class DiffusionController extends PhabricatorController {
// //
// ...to get a human-readable error. // ...to get a human-readable error.
$vcs = $request->getExists('__vcs__'); $vcs = $request->getExists('__vcs__');
} else if (strncmp($user_agent, "git/", 4) === 0) {
$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
} else if ($request->getExists('service')) { } else if ($request->getExists('service')) {
$service = $request->getStr('service'); $service = $request->getStr('service');
// We get this initially for `info/refs`. // We get this initially for `info/refs`.
@ -541,6 +545,16 @@ abstract class DiffusionController extends PhabricatorController {
return null; return null;
} }
if (!strlen($username)) {
// No username.
return null;
}
if (!strlen($password->openEnvelope())) {
// No password.
return null;
}
$user = id(new PhabricatorPeopleQuery()) $user = id(new PhabricatorPeopleQuery())
->setViewer(PhabricatorUser::getOmnipotentUser()) ->setViewer(PhabricatorUser::getOmnipotentUser())
->withUsernames(array($username)) ->withUsernames(array($username))