func getDashboardContextUser(ctx *middleware.Context) *models.User {
ctxUser := ctx.User
orgName := ctx.Params(":org")
if len(orgName) > 0 {
// Organization.
org, err := models.GetUserByName(orgName)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Handle(404, "GetUserByName", err)
} else {
ctx.Handle(500, "GetUserByName", err)
}
return nil
}
ctxUser = org
}
ctx.Data["ContextUser"] = ctxUser
if err := ctx.User.GetOrganizations(); err != nil {
ctx.Handle(500, "GetOrganizations", err)
return nil
}
ctx.Data["Orgs"] = ctx.User.Orgs
return ctxUser
}
func SettingsDelete(ctx *middleware.Context) {
ctx.Data["Title"] = ctx.Tr("org.settings")
ctx.Data["PageIsSettingsDelete"] = true
org := ctx.Org.Organization
if ctx.Req.Method == "POST" {
if _, err := models.UserSignIn(ctx.User.Name, ctx.Query("password")); err != nil {
if models.IsErrUserNotExist(err) {
ctx.RenderWithErr(ctx.Tr("form.enterred_invalid_password"), SETTINGS_DELETE, nil)
} else {
ctx.Handle(500, "UserSignIn", err)
}
return
}
if err := models.DeleteOrganization(org); err != nil {
if models.IsErrUserOwnRepos(err) {
ctx.Flash.Error(ctx.Tr("form.org_still_own_repo"))
ctx.Redirect(org.HomeLink() + "/settings/delete")
} else {
ctx.Handle(500, "DeleteOrganization", err)
}
} else {
log.Trace("Organization deleted: %s", org.Name)
ctx.Redirect(setting.AppSubUrl + "/")
}
return
}
ctx.HTML(200, SETTINGS_DELETE)
}
func DeleteRepo(ctx *middleware.Context) {
user, err := models.GetUserByName(ctx.Params(":username"))
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.APIError(422, "", err)
} else {
ctx.APIError(500, "GetUserByName", err)
}
return
}
repo, err := models.GetRepositoryByName(user.Id, ctx.Params(":reponame"))
if err != nil {
if models.IsErrRepoNotExist(err) {
ctx.Error(404)
} else {
ctx.APIError(500, "GetRepositoryByName", err)
}
return
}
if user.IsOrganization() && !user.IsOwnedBy(ctx.User.Id) {
ctx.APIError(403, "", "Given user is not owner of organization.")
return
}
if err := models.DeleteRepository(user.Id, repo.ID); err != nil {
ctx.APIError(500, "DeleteRepository", err)
return
}
log.Trace("Repository deleted: %s/%s", user.Name, repo.Name)
ctx.Status(204)
}
func SignInPost(ctx *middleware.Context, form auth.SignInForm) {
ctx.Data["Title"] = ctx.Tr("sign_in")
if ctx.HasError() {
ctx.HTML(200, SIGNIN)
return
}
u, err := models.UserSignIn(form.UserName, form.Password)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.RenderWithErr(ctx.Tr("form.username_password_incorrect"), SIGNIN, &form)
} else {
ctx.Handle(500, "UserSignIn", err)
}
return
}
if form.Remember {
days := 86400 * setting.LogInRememberDays
ctx.SetCookie(setting.CookieUserName, u.Name, days, setting.AppSubUrl)
ctx.SetSuperSecureCookie(base.EncodeMd5(u.Rands+u.Passwd),
setting.CookieRememberName, u.Name, days, setting.AppSubUrl)
}
ctx.Session.Set("uid", u.Id)
ctx.Session.Set("uname", u.Name)
if redirectTo, _ := url.QueryUnescape(ctx.GetCookie("redirect_to")); len(redirectTo) > 0 {
ctx.SetCookie("redirect_to", "", -1, setting.AppSubUrl)
ctx.Redirect(redirectTo)
return
}
ctx.Redirect(setting.AppSubUrl + "/")
}
func checkContextUser(ctx *middleware.Context, uid int64) *models.User {
orgs, err := models.GetOwnedOrgsByUserIDDesc(ctx.User.Id, "updated")
if err != nil {
ctx.Handle(500, "GetOwnedOrgsByUserIDDesc", err)
return nil
}
ctx.Data["Orgs"] = orgs
// Not equal means current user is an organization.
if uid == ctx.User.Id || uid == 0 {
return ctx.User
}
org, err := models.GetUserByID(uid)
if models.IsErrUserNotExist(err) {
return ctx.User
}
if err != nil {
ctx.Handle(500, "checkContextUser", fmt.Errorf("GetUserById(%d): %v", uid, err))
return nil
}
// Check ownership of organization.
if !org.IsOrganization() || !org.IsOwnedBy(ctx.User.Id) {
ctx.Error(403)
return nil
}
return org
}
func Invitation(ctx *middleware.Context) {
org := ctx.Org.Organization
ctx.Data["Title"] = org.FullName
ctx.Data["PageIsOrgMembers"] = true
if ctx.Req.Method == "POST" {
uname := ctx.Query("uname")
u, err := models.GetUserByName(uname)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Flash.Error(ctx.Tr("form.user_not_exist"))
ctx.Redirect(ctx.Org.OrgLink + "/invitations/new")
} else {
ctx.Handle(500, " GetUserByName", err)
}
return
}
if err = org.AddMember(u.Id); err != nil {
ctx.Handle(500, " AddMember", err)
return
}
log.Trace("New member added(%s): %s", org.Name, u.Name)
ctx.Redirect(ctx.Org.OrgLink + "/members")
return
}
ctx.HTML(200, MEMBER_INVITE)
}
func ApiRepoAssignment() macaron.Handler {
return func(ctx *Context) {
userName := ctx.Params(":username")
repoName := ctx.Params(":reponame")
var (
u *models.User
err error
)
// Check if the user is the same as the repository owner.
if ctx.IsSigned && ctx.User.LowerName == strings.ToLower(userName) {
u = ctx.User
} else {
u, err = models.GetUserByName(userName)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Error(404)
} else {
ctx.APIError(500, "GetUserByName", err)
}
return
}
}
ctx.Repo.Owner = u
// Get repository.
repo, err := models.GetRepositoryByName(u.Id, repoName)
if err != nil {
if models.IsErrRepoNotExist(err) {
ctx.Error(404)
} else {
ctx.APIError(500, "GetRepositoryByName", err)
}
return
} else if err = repo.GetOwner(); err != nil {
ctx.APIError(500, "GetOwner", err)
return
}
mode, err := models.AccessLevel(ctx.User, repo)
if err != nil {
ctx.APIError(500, "AccessLevel", err)
return
}
ctx.Repo.AccessMode = mode
// Check access.
if ctx.Repo.AccessMode == models.ACCESS_MODE_NONE {
ctx.Error(404)
return
}
ctx.Repo.Repository = repo
}
}
func Email2User(ctx *middleware.Context) {
u, err := models.GetUserByEmail(ctx.Query("email"))
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Handle(404, "GetUserByEmail", err)
} else {
ctx.Handle(500, "GetUserByEmail", err)
}
return
}
ctx.Redirect(setting.AppSubUrl + "/user/" + u.Name)
}
// SignedInID returns the id of signed in user.
func SignedInID(ctx *macaron.Context, sess session.Store) int64 {
if !models.HasEngine {
return 0
}
// Check access token.
if IsAPIPath(ctx.Req.URL.Path) {
tokenSHA := ctx.Query("token")
if len(tokenSHA) == 0 {
// Well, check with header again.
auHead := ctx.Req.Header.Get("Authorization")
if len(auHead) > 0 {
auths := strings.Fields(auHead)
if len(auths) == 2 && auths[0] == "token" {
tokenSHA = auths[1]
}
}
}
// Let's see if token is valid.
if len(tokenSHA) > 0 {
t, err := models.GetAccessTokenBySHA(tokenSHA)
if err != nil {
if models.IsErrAccessTokenNotExist(err) {
log.Error(4, "GetAccessTokenBySHA: %v", err)
}
return 0
}
t.Updated = time.Now()
if err = models.UpdateAccessToekn(t); err != nil {
log.Error(4, "UpdateAccessToekn: %v", err)
}
return t.UID
}
}
uid := sess.Get("uid")
if uid == nil {
return 0
}
if id, ok := uid.(int64); ok {
if _, err := models.GetUserByID(id); err != nil {
if !models.IsErrUserNotExist(err) {
log.Error(4, "GetUserById: %v", err)
}
return 0
}
return id
}
return 0
}
func Activate(ctx *middleware.Context) {
code := ctx.Query("code")
if len(code) == 0 {
ctx.Data["IsActivatePage"] = true
if ctx.User.IsActive {
ctx.Error(404)
return
}
// Resend confirmation e-mail.
if setting.Service.RegisterEmailConfirm {
if ctx.Cache.IsExist("MailResendLimit_" + ctx.User.LowerName) {
ctx.Data["ResendLimited"] = true
} else {
ctx.Data["Hours"] = setting.Service.ActiveCodeLives / 60
mailer.SendActivateAccountMail(ctx.Context, ctx.User)
if err := ctx.Cache.Put("MailResendLimit_"+ctx.User.LowerName, ctx.User.LowerName, 180); err != nil {
log.Error(4, "Set cache(MailResendLimit) fail: %v", err)
}
}
} else {
ctx.Data["ServiceNotEnabled"] = true
}
ctx.HTML(200, ACTIVATE)
return
}
// Verify code.
if user := models.VerifyUserActiveCode(code); user != nil {
user.IsActive = true
user.Rands = models.GetUserSalt()
if err := models.UpdateUser(user); err != nil {
if models.IsErrUserNotExist(err) {
ctx.Error(404)
} else {
ctx.Handle(500, "UpdateUser", err)
}
return
}
log.Trace("User activated: %s", user.Name)
ctx.Session.Set("uid", user.Id)
ctx.Session.Set("uname", user.Name)
ctx.Redirect(setting.AppSubUrl + "/")
return
}
ctx.Data["IsActivateFailed"] = true
ctx.HTML(200, ACTIVATE)
}
func CreateOrgRepo(ctx *middleware.Context, opt api.CreateRepoOption) {
org, err := models.GetOrgByName(ctx.Params(":org"))
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.APIError(422, "", err)
} else {
ctx.APIError(500, "GetOrgByName", err)
}
return
}
if !org.IsOwnedBy(ctx.User.Id) {
ctx.APIError(403, "", "Given user is not owner of organization.")
return
}
createRepo(ctx, org, opt)
}
// GET /users/:username
func GetUserInfo(ctx *middleware.Context) {
u, err := models.GetUserByName(ctx.Params(":username"))
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Error(404)
} else {
ctx.APIError(500, "GetUserByName", err)
}
return
}
// Hide user e-mail when API caller isn't signed in.
if !ctx.IsSigned {
u.Email = ""
}
ctx.JSON(200, &api.User{u.Id, u.Name, u.FullName, u.Email, u.AvatarLink()})
}
func ForgotPasswdPost(ctx *middleware.Context) {
ctx.Data["Title"] = ctx.Tr("auth.forgot_password")
if setting.MailService == nil {
ctx.Handle(403, "ForgotPasswdPost", nil)
return
}
ctx.Data["IsResetRequest"] = true
email := ctx.Query("email")
ctx.Data["Email"] = email
u, err := models.GetUserByEmail(email)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Data["Err_Email"] = true
ctx.RenderWithErr(ctx.Tr("auth.email_not_associate"), FORGOT_PASSWORD, nil)
} else {
ctx.Handle(500, "user.ResetPasswd(check existence)", err)
}
return
}
if ctx.Cache.IsExist("MailResendLimit_" + u.LowerName) {
ctx.Data["ResendLimited"] = true
ctx.HTML(200, FORGOT_PASSWORD)
return
}
mailer.SendResetPasswordMail(ctx.Context, u)
if err = ctx.Cache.Put("MailResendLimit_"+u.LowerName, u.LowerName, 180); err != nil {
log.Error(4, "Set cache(MailResendLimit) fail: %v", err)
}
ctx.Data["Hours"] = setting.Service.ActiveCodeLives / 60
ctx.Data["IsResetSent"] = true
ctx.HTML(200, FORGOT_PASSWORD)
}
func TriggerHook(ctx *middleware.Context) {
u, err := models.GetUserByName(ctx.Params(":username"))
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Handle(404, "GetUserByName", err)
} else {
ctx.Handle(500, "GetUserByName", err)
}
return
}
repo, err := models.GetRepositoryByName(u.Id, ctx.Params(":reponame"))
if err != nil {
if models.IsErrRepoNotExist(err) {
ctx.Handle(404, "GetRepositoryByName", err)
} else {
ctx.Handle(500, "GetRepositoryByName", err)
}
return
}
models.HookQueue.AddRepoID(repo.ID)
ctx.Status(200)
}
// AutoSignIn reads cookie and try to auto-login.
func AutoSignIn(ctx *Context) (bool, error) {
if !models.HasEngine {
return false, nil
}
uname := ctx.GetCookie(setting.CookieUserName)
if len(uname) == 0 {
return false, nil
}
isSucceed := false
defer func() {
if !isSucceed {
log.Trace("auto-login cookie cleared: %s", uname)
ctx.SetCookie(setting.CookieUserName, "", -1, setting.AppSubUrl)
ctx.SetCookie(setting.CookieRememberName, "", -1, setting.AppSubUrl)
}
}()
u, err := models.GetUserByName(uname)
if err != nil {
if !models.IsErrUserNotExist(err) {
return false, fmt.Errorf("GetUserByName: %v", err)
}
return false, nil
}
if val, _ := ctx.GetSuperSecureCookie(
base.EncodeMd5(u.Rands+u.Passwd), setting.CookieRememberName); val != u.Name {
return false, nil
}
isSucceed = true
ctx.Session.Set("uid", u.Id)
ctx.Session.Set("uname", u.Name)
return true, nil
}
func OrgAssignment(redirect bool, args ...bool) macaron.Handler {
return func(ctx *Context) {
var (
requireMember bool
requireOwner bool
requireAdminTeam bool
)
if len(args) >= 1 {
requireMember = args[0]
}
if len(args) >= 2 {
requireOwner = args[1]
}
if len(args) >= 3 {
requireAdminTeam = args[2]
}
orgName := ctx.Params(":org")
var err error
ctx.Org.Organization, err = models.GetUserByName(orgName)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Handle(404, "GetUserByName", err)
} else if redirect {
log.Error(4, "GetUserByName", err)
ctx.Redirect(setting.AppSubUrl + "/")
} else {
ctx.Handle(500, "GetUserByName", err)
}
return
}
org := ctx.Org.Organization
ctx.Data["Org"] = org
// Force redirection when username is actually a user.
if !org.IsOrganization() {
ctx.Redirect("/" + org.Name)
return
}
if ctx.IsSigned {
ctx.Org.IsOwner = org.IsOwnedBy(ctx.User.Id)
if ctx.Org.IsOwner {
ctx.Org.IsMember = true
ctx.Org.IsAdminTeam = true
} else {
if org.IsOrgMember(ctx.User.Id) {
ctx.Org.IsMember = true
}
}
} else {
// Fake data.
ctx.Data["SignedUser"] = &models.User{}
}
if (requireMember && !ctx.Org.IsMember) ||
(requireOwner && !ctx.Org.IsOwner) {
ctx.Handle(404, "OrgAssignment", err)
return
}
ctx.Data["IsOrganizationOwner"] = ctx.Org.IsOwner
ctx.Org.OrgLink = setting.AppSubUrl + "/org/" + org.Name
ctx.Data["OrgLink"] = ctx.Org.OrgLink
// Team.
teamName := ctx.Params(":team")
if len(teamName) > 0 {
ctx.Org.Team, err = org.GetTeam(teamName)
if err != nil {
if err == models.ErrTeamNotExist {
ctx.Handle(404, "GetTeam", err)
} else if redirect {
log.Error(4, "GetTeam", err)
ctx.Redirect(setting.AppSubUrl + "/")
} else {
ctx.Handle(500, "GetTeam", err)
}
return
}
ctx.Data["Team"] = ctx.Org.Team
ctx.Org.IsAdminTeam = ctx.Org.Team.IsOwnerTeam() || ctx.Org.Team.Authorize >= models.ACCESS_MODE_ADMIN
}
ctx.Data["IsAdminTeam"] = ctx.Org.IsAdminTeam
if requireAdminTeam && !ctx.Org.IsAdminTeam {
ctx.Handle(404, "OrgAssignment", err)
return
}
}
}
func MigrateRepo(ctx *middleware.Context, form auth.MigrateRepoForm) {
ctxUser := ctx.User
// Not equal means current user is an organization.
if form.Uid != ctxUser.Id {
org, err := models.GetUserByID(form.Uid)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.APIError(422, "", err)
} else {
ctx.APIError(500, "GetUserByID", err)
}
return
}
ctxUser = org
}
if ctx.HasError() {
ctx.APIError(422, "", ctx.GetErrMsg())
return
}
if ctxUser.IsOrganization() {
// Check ownership of organization.
if !ctxUser.IsOwnedBy(ctx.User.Id) {
ctx.APIError(403, "", "Given user is not owner of organization.")
return
}
}
// Remote address can be HTTP/HTTPS/Git URL or local path.
remoteAddr := form.CloneAddr
if strings.HasPrefix(form.CloneAddr, "http://") ||
strings.HasPrefix(form.CloneAddr, "https://") ||
strings.HasPrefix(form.CloneAddr, "git://") {
u, err := url.Parse(form.CloneAddr)
if err != nil {
ctx.APIError(422, "", err)
return
}
if len(form.AuthUsername) > 0 || len(form.AuthPassword) > 0 {
u.User = url.UserPassword(form.AuthUsername, form.AuthPassword)
}
remoteAddr = u.String()
} else if !com.IsDir(remoteAddr) {
ctx.APIError(422, "", "Invalid local path, it does not exist or not a directory.")
return
}
repo, err := models.MigrateRepository(ctxUser, form.RepoName, form.Description, form.Private, form.Mirror, remoteAddr)
if err != nil {
if repo != nil {
if errDelete := models.DeleteRepository(ctxUser.Id, repo.ID); errDelete != nil {
log.Error(4, "DeleteRepository: %v", errDelete)
}
}
ctx.APIError(500, "MigrateRepository", err)
return
}
log.Trace("Repository migrated: %s/%s", ctxUser.Name, form.RepoName)
ctx.JSON(201, ToApiRepository(ctxUser, repo, api.Permission{true, true, true}))
}
func Collaboration(ctx *middleware.Context) {
ctx.Data["Title"] = ctx.Tr("repo.settings")
ctx.Data["PageIsSettingsCollaboration"] = true
if ctx.Req.Method == "POST" {
name := strings.ToLower(ctx.Query("collaborator"))
if len(name) == 0 || ctx.Repo.Owner.LowerName == name {
ctx.Redirect(setting.AppSubUrl + ctx.Req.URL.Path)
return
}
u, err := models.GetUserByName(name)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Flash.Error(ctx.Tr("form.user_not_exist"))
ctx.Redirect(setting.AppSubUrl + ctx.Req.URL.Path)
} else {
ctx.Handle(500, "GetUserByName", err)
}
return
}
// Check if user is organization member.
if ctx.Repo.Owner.IsOrganization() && ctx.Repo.Owner.IsOrgMember(u.Id) {
ctx.Flash.Info(ctx.Tr("repo.settings.user_is_org_member"))
ctx.Redirect(ctx.Repo.RepoLink + "/settings/collaboration")
return
}
if err = ctx.Repo.Repository.AddCollaborator(u); err != nil {
ctx.Handle(500, "AddCollaborator", err)
return
}
if setting.Service.EnableNotifyMail {
if err = mailer.SendCollaboratorMail(ctx.Render, u, ctx.User, ctx.Repo.Repository); err != nil {
ctx.Handle(500, "SendCollaboratorMail", err)
return
}
}
ctx.Flash.Success(ctx.Tr("repo.settings.add_collaborator_success"))
ctx.Redirect(setting.AppSubUrl + ctx.Req.URL.Path)
return
}
// Delete collaborator.
remove := strings.ToLower(ctx.Query("remove"))
if len(remove) > 0 && remove != ctx.Repo.Owner.LowerName {
u, err := models.GetUserByName(remove)
if err != nil {
ctx.Handle(500, "GetUserByName", err)
return
}
if err := ctx.Repo.Repository.DeleteCollaborator(u); err != nil {
ctx.Handle(500, "DeleteCollaborator", err)
return
}
ctx.Flash.Success(ctx.Tr("repo.settings.remove_collaborator_success"))
ctx.Redirect(ctx.Repo.RepoLink + "/settings/collaboration")
return
}
users, err := ctx.Repo.Repository.GetCollaborators()
if err != nil {
ctx.Handle(500, "GetCollaborators", err)
return
}
ctx.Data["Collaborators"] = users
ctx.HTML(200, COLLABORATION)
}
func Http(ctx *middleware.Context) {
username := ctx.Params(":username")
reponame := ctx.Params(":reponame")
if strings.HasSuffix(reponame, ".git") {
reponame = reponame[:len(reponame)-4]
}
var isPull bool
service := ctx.Query("service")
if service == "git-receive-pack" ||
strings.HasSuffix(ctx.Req.URL.Path, "git-receive-pack") {
isPull = false
} else if service == "git-upload-pack" ||
strings.HasSuffix(ctx.Req.URL.Path, "git-upload-pack") {
isPull = true
} else {
isPull = (ctx.Req.Method == "GET")
}
repoUser, err := models.GetUserByName(username)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Handle(404, "GetUserByName", nil)
} else {
ctx.Handle(500, "GetUserByName", err)
}
return
}
repo, err := models.GetRepositoryByName(repoUser.Id, reponame)
if err != nil {
if models.IsErrRepoNotExist(err) {
ctx.Handle(404, "GetRepositoryByName", nil)
} else {
ctx.Handle(500, "GetRepositoryByName", err)
}
return
}
// Only public pull don't need auth.
isPublicPull := !repo.IsPrivate && isPull
var (
askAuth = !isPublicPull || setting.Service.RequireSignInView
authUser *models.User
authUsername string
authPasswd string
)
// check access
if askAuth {
baHead := ctx.Req.Header.Get("Authorization")
if baHead == "" {
authRequired(ctx)
return
}
auths := strings.Fields(baHead)
// currently check basic auth
// TODO: support digit auth
// FIXME: middlewares/context.go did basic auth check already,
// maybe could use that one.
if len(auths) != 2 || auths[0] != "Basic" {
ctx.HandleText(401, "no basic auth and digit auth")
return
}
authUsername, authPasswd, err = base.BasicAuthDecode(auths[1])
if err != nil {
ctx.HandleText(401, "no basic auth and digit auth")
return
}
authUser, err = models.UserSignIn(authUsername, authPasswd)
if err != nil {
if !models.IsErrUserNotExist(err) {
ctx.Handle(500, "UserSignIn error: %v", err)
return
}
// Assume username now is a token.
token, err := models.GetAccessTokenBySHA(authUsername)
if err != nil {
if models.IsErrAccessTokenNotExist(err) {
ctx.HandleText(401, "invalid token")
} else {
ctx.Handle(500, "GetAccessTokenBySha", err)
}
return
}
token.Updated = time.Now()
if err = models.UpdateAccessToekn(token); err != nil {
ctx.Handle(500, "UpdateAccessToekn", err)
}
authUser, err = models.GetUserByID(token.UID)
if err != nil {
ctx.Handle(500, "GetUserById", err)
return
}
authUsername = authUser.Name
}
if !isPublicPull {
var tp = models.ACCESS_MODE_WRITE
if isPull {
tp = models.ACCESS_MODE_READ
}
has, err := models.HasAccess(authUser, repo, tp)
if err != nil {
ctx.HandleText(401, "no basic auth and digit auth")
return
} else if !has {
if tp == models.ACCESS_MODE_READ {
has, err = models.HasAccess(authUser, repo, models.ACCESS_MODE_WRITE)
if err != nil || !has {
ctx.HandleText(401, "no basic auth and digit auth")
return
}
} else {
ctx.HandleText(401, "no basic auth and digit auth")
return
}
}
if !isPull && repo.IsMirror {
ctx.HandleText(401, "can't push to mirror")
return
}
}
}
callback := func(rpc string, input []byte) {
if rpc == "receive-pack" {
var lastLine int64 = 0
for {
head := input[lastLine : lastLine+2]
if head[0] == '0' && head[1] == '0' {
size, err := strconv.ParseInt(string(input[lastLine+2:lastLine+4]), 16, 32)
if err != nil {
log.Error(4, "%v", err)
return
}
if size == 0 {
//fmt.Println(string(input[lastLine:]))
break
}
line := input[lastLine : lastLine+size]
idx := bytes.IndexRune(line, '\000')
if idx > -1 {
line = line[:idx]
}
fields := strings.Fields(string(line))
if len(fields) >= 3 {
oldCommitId := fields[0][4:]
newCommitId := fields[1]
refName := fields[2]
// FIXME: handle error.
if err = models.Update(refName, oldCommitId, newCommitId, authUsername, username, reponame, authUser.Id); err == nil {
models.HookQueue.AddRepoID(repo.ID)
}
}
lastLine = lastLine + size
} else {
break
}
}
}
}
HTTPBackend(&Config{
RepoRootPath: setting.RepoRootPath,
GitBinPath: "git",
UploadPack: true,
ReceivePack: true,
OnSucceed: callback,
})(ctx.Resp, ctx.Req.Request)
runtime.GC()
}
func RepoAssignment(redirect bool, args ...bool) macaron.Handler {
return func(ctx *Context) {
var (
displayBare bool // To display bare page if it is a bare repo.
)
if len(args) >= 1 {
displayBare = args[0]
}
var (
u *models.User
err error
)
userName := ctx.Params(":username")
repoName := ctx.Params(":reponame")
refName := ctx.Params(":branchname")
if len(refName) == 0 {
refName = ctx.Params(":path")
}
// Check if the user is the same as the repository owner
if ctx.IsSigned && ctx.User.LowerName == strings.ToLower(userName) {
u = ctx.User
} else {
u, err = models.GetUserByName(userName)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Handle(404, "GetUserByName", err)
} else {
ctx.Handle(500, "GetUserByName", err)
}
return
}
}
ctx.Repo.Owner = u
// Get repository.
repo, err := models.GetRepositoryByName(u.Id, repoName)
if err != nil {
if models.IsErrRepoNotExist(err) {
ctx.Handle(404, "GetRepositoryByName", err)
} else {
ctx.Handle(500, "GetRepositoryByName", err)
}
return
} else if err = repo.GetOwner(); err != nil {
ctx.Handle(500, "GetOwner", err)
return
}
mode, err := models.AccessLevel(ctx.User, repo)
if err != nil {
ctx.Handle(500, "AccessLevel", err)
return
}
ctx.Repo.AccessMode = mode
// Check access.
if ctx.Repo.AccessMode == models.ACCESS_MODE_NONE {
ctx.Handle(404, "no access right", err)
return
}
ctx.Data["HasAccess"] = true
if repo.IsMirror {
ctx.Repo.Mirror, err = models.GetMirror(repo.ID)
if err != nil {
ctx.Handle(500, "GetMirror", err)
return
}
ctx.Data["MirrorInterval"] = ctx.Repo.Mirror.Interval
}
ctx.Repo.Repository = repo
ctx.Data["IsBareRepo"] = ctx.Repo.Repository.IsBare
gitRepo, err := git.OpenRepository(models.RepoPath(userName, repoName))
if err != nil {
ctx.Handle(500, "RepoAssignment Invalid repo "+models.RepoPath(userName, repoName), err)
return
}
ctx.Repo.GitRepo = gitRepo
ctx.Repo.RepoLink, err = repo.RepoLink()
if err != nil {
ctx.Handle(500, "RepoLink", err)
return
}
ctx.Data["RepoLink"] = ctx.Repo.RepoLink
ctx.Data["RepoRelPath"] = ctx.Repo.Owner.Name + "/" + ctx.Repo.Repository.Name
tags, err := ctx.Repo.GitRepo.GetTags()
if err != nil {
ctx.Handle(500, "GetTags", err)
return
}
ctx.Data["Tags"] = tags
ctx.Repo.Repository.NumTags = len(tags)
if repo.IsFork {
RetrieveBaseRepo(ctx, repo)
if ctx.Written() {
return
}
}
ctx.Data["Title"] = u.Name + "/" + repo.Name
ctx.Data["Repository"] = repo
ctx.Data["Owner"] = ctx.Repo.Repository.Owner
ctx.Data["IsRepositoryOwner"] = ctx.Repo.IsOwner()
ctx.Data["IsRepositoryAdmin"] = ctx.Repo.IsAdmin()
ctx.Data["DisableSSH"] = setting.DisableSSH
ctx.Repo.CloneLink, err = repo.CloneLink()
if err != nil {
ctx.Handle(500, "CloneLink", err)
return
}
ctx.Data["CloneLink"] = ctx.Repo.CloneLink
if ctx.Query("go-get") == "1" {
ctx.Data["GoGetImport"] = fmt.Sprintf("%s/%s/%s", setting.Domain, u.Name, repo.Name)
}
if ctx.IsSigned {
ctx.Data["IsWatchingRepo"] = models.IsWatching(ctx.User.Id, repo.ID)
ctx.Data["IsStaringRepo"] = models.IsStaring(ctx.User.Id, repo.ID)
}
// repo is bare and display enable
if ctx.Repo.Repository.IsBare {
log.Debug("Bare repository: %s", ctx.Repo.RepoLink)
// NOTE: to prevent templating error
ctx.Data["BranchName"] = ""
if displayBare {
if !ctx.Repo.IsAdmin() {
ctx.Flash.Info(ctx.Tr("repo.repo_is_empty"), true)
}
ctx.HTML(200, "repo/bare")
}
return
}
ctx.Data["TagName"] = ctx.Repo.TagName
brs, err := ctx.Repo.GitRepo.GetBranches()
if err != nil {
ctx.Handle(500, "GetBranches", err)
return
}
ctx.Data["Branches"] = brs
ctx.Data["BrancheCount"] = len(brs)
// If not branch selected, try default one.
// If default branch doesn't exists, fall back to some other branch.
if len(ctx.Repo.BranchName) == 0 {
if len(ctx.Repo.Repository.DefaultBranch) > 0 && gitRepo.IsBranchExist(ctx.Repo.Repository.DefaultBranch) {
ctx.Repo.BranchName = ctx.Repo.Repository.DefaultBranch
} else if len(brs) > 0 {
ctx.Repo.BranchName = brs[0]
}
}
ctx.Data["BranchName"] = ctx.Repo.BranchName
ctx.Data["CommitID"] = ctx.Repo.CommitID
userAgent := ctx.Req.Header.Get("User-Agent")
ua := user_agent.New(userAgent)
browserName, browserVer := ua.Browser()
ctx.Data["BrowserSupportsCopy"] = (browserName == "Chrome" && version.Compare(browserVer, CHROME_COPY_SUPPORT, ">=")) ||
(browserName == "Firefox" && version.Compare(browserVer, FIREFOX_COPY_SUPPORT, ">="))
}
}
func runServ(c *cli.Context) {
if c.IsSet("config") {
setting.CustomConf = c.String("config")
}
setup("serv.log")
if len(c.Args()) < 1 {
fail("Not enough arguments", "Not enough arguments")
}
cmd := os.Getenv("SSH_ORIGINAL_COMMAND")
if len(cmd) == 0 {
println("Hi there, You've successfully authenticated, but Gogs does not provide shell access.")
println("If this is unexpected, please log in with password and setup Gogs under another user.")
return
}
verb, args := parseCmd(cmd)
repoPath := strings.Trim(args, "'")
rr := strings.SplitN(repoPath, "/", 2)
if len(rr) != 2 {
fail("Invalid repository path", "Invalid repository path: %v", args)
}
repoUserName := rr[0]
repoName := strings.TrimSuffix(rr[1], ".git")
repoUser, err := models.GetUserByName(repoUserName)
if err != nil {
if models.IsErrUserNotExist(err) {
fail("Repository owner does not exist", "Unregistered owner: %s", repoUserName)
}
fail("Internal error", "Failed to get repository owner(%s): %v", repoUserName, err)
}
repo, err := models.GetRepositoryByName(repoUser.Id, repoName)
if err != nil {
if models.IsErrRepoNotExist(err) {
fail(_ACCESS_DENIED_MESSAGE, "Repository does not exist: %s/%s", repoUser.Name, repoName)
}
fail("Internal error", "Failed to get repository: %v", err)
}
requestedMode, has := COMMANDS[verb]
if !has {
fail("Unknown git command", "Unknown git command %s", verb)
}
// Allow anonymous clone for public repositories.
var (
keyID int64
user *models.User
)
if requestedMode == models.ACCESS_MODE_WRITE || repo.IsPrivate {
keys := strings.Split(c.Args()[0], "-")
if len(keys) != 2 {
fail("Key ID format error", "Invalid key ID: %s", c.Args()[0])
}
key, err := models.GetPublicKeyByID(com.StrTo(keys[1]).MustInt64())
if err != nil {
fail("Key ID format error", "Invalid key ID[%s]: %v", c.Args()[0], err)
}
keyID = key.ID
// Check deploy key or user key.
if key.Type == models.KEY_TYPE_DEPLOY {
if key.Mode < requestedMode {
fail("Key permission denied", "Cannot push with deployment key: %d", key.ID)
}
// Check if this deploy key belongs to current repository.
if !models.HasDeployKey(key.ID, repo.ID) {
fail("Key access denied", "Key access denied: %d-%d", key.ID, repo.ID)
}
// Update deploy key activity.
deployKey, err := models.GetDeployKeyByRepo(key.ID, repo.ID)
if err != nil {
fail("Internal error", "GetDeployKey: %v", err)
}
deployKey.Updated = time.Now()
if err = models.UpdateDeployKey(deployKey); err != nil {
fail("Internal error", "UpdateDeployKey: %v", err)
}
} else {
user, err = models.GetUserByKeyId(key.ID)
if err != nil {
fail("internal error", "Failed to get user by key ID(%d): %v", keyID, err)
}
mode, err := models.AccessLevel(user, repo)
if err != nil {
fail("Internal error", "Fail to check access: %v", err)
} else if mode < requestedMode {
clientMessage := _ACCESS_DENIED_MESSAGE
if mode >= models.ACCESS_MODE_READ {
clientMessage = "You do not have sufficient authorization for this action"
}
fail(clientMessage,
"User %s does not have level %v access to repository %s",
user.Name, requestedMode, repoPath)
}
}
}
uuid := uuid.NewV4().String()
os.Setenv("uuid", uuid)
var gitcmd *exec.Cmd
verbs := strings.Split(verb, " ")
if len(verbs) == 2 {
gitcmd = exec.Command(verbs[0], verbs[1], repoPath)
} else {
gitcmd = exec.Command(verb, repoPath)
}
gitcmd.Dir = setting.RepoRootPath
gitcmd.Stdout = os.Stdout
gitcmd.Stdin = os.Stdin
gitcmd.Stderr = os.Stderr
if err = gitcmd.Run(); err != nil {
fail("Internal error", "Failed to execute git command: %v", err)
}
if requestedMode == models.ACCESS_MODE_WRITE {
tasks, err := models.GetUpdateTasksByUuid(uuid)
if err != nil {
log.GitLogger.Fatal(2, "GetUpdateTasksByUuid: %v", err)
}
for _, task := range tasks {
err = models.Update(task.RefName, task.OldCommitId, task.NewCommitId,
user.Name, repoUserName, repoName, user.Id)
if err != nil {
log.GitLogger.Error(2, "Failed to update: %v", err)
}
}
if err = models.DelUpdateTasksByUuid(uuid); err != nil {
log.GitLogger.Fatal(2, "DelUpdateTasksByUuid: %v", err)
}
}
// Send deliver hook request.
reqURL := setting.AppUrl + repoUserName + "/" + repoName + "/hooks/trigger"
resp, err := httplib.Head(reqURL).Response()
if err == nil {
resp.Body.Close()
log.GitLogger.Trace("Trigger hook: %s", reqURL)
} else {
log.GitLogger.Error(2, "Fail to trigger hook: %v", err)
}
// Update user key activity.
if keyID > 0 {
key, err := models.GetPublicKeyByID(keyID)
if err != nil {
fail("Internal error", "GetPublicKeyById: %v", err)
}
key.Updated = time.Now()
if err = models.UpdatePublicKey(key); err != nil {
fail("Internal error", "UpdatePublicKey: %v", err)
}
}
}
// SignedInUser returns the user object of signed user.
// It returns a bool value to indicate whether user uses basic auth or not.
func SignedInUser(ctx *macaron.Context, sess session.Store) (*models.User, bool) {
if !models.HasEngine {
return nil, false
}
uid := SignedInID(ctx, sess)
if uid <= 0 {
if setting.Service.EnableReverseProxyAuth {
webAuthUser := ctx.Req.Header.Get(setting.ReverseProxyAuthUser)
if len(webAuthUser) > 0 {
u, err := models.GetUserByName(webAuthUser)
if err != nil {
if !models.IsErrUserNotExist(err) {
log.Error(4, "GetUserByName: %v", err)
return nil, false
}
// Check if enabled auto-registration.
if setting.Service.EnableReverseProxyAutoRegister {
u := &models.User{
Name: webAuthUser,
Email: uuid.NewV4().String() + "@localhost",
Passwd: webAuthUser,
IsActive: true,
}
if err = models.CreateUser(u); err != nil {
// FIXME: should I create a system notice?
log.Error(4, "CreateUser: %v", err)
return nil, false
} else {
return u, false
}
}
}
return u, false
}
}
// Check with basic auth.
baHead := ctx.Req.Header.Get("Authorization")
if len(baHead) > 0 {
auths := strings.Fields(baHead)
if len(auths) == 2 && auths[0] == "Basic" {
uname, passwd, _ := base.BasicAuthDecode(auths[1])
u, err := models.UserSignIn(uname, passwd)
if err != nil {
if !models.IsErrUserNotExist(err) {
log.Error(4, "UserSignIn: %v", err)
}
return nil, false
}
return u, true
}
}
return nil, false
}
u, err := models.GetUserByID(uid)
if err != nil {
log.Error(4, "GetUserById: %v", err)
return nil, false
}
return u, false
}
func TeamsAction(ctx *middleware.Context) {
uid := com.StrTo(ctx.Query("uid")).MustInt64()
if uid == 0 {
ctx.Redirect(ctx.Org.OrgLink + "/teams")
return
}
page := ctx.Query("page")
var err error
switch ctx.Params(":action") {
case "join":
if !ctx.Org.IsOwner {
ctx.Error(404)
return
}
err = ctx.Org.Team.AddMember(ctx.User.Id)
case "leave":
err = ctx.Org.Team.RemoveMember(ctx.User.Id)
case "remove":
if !ctx.Org.IsOwner {
ctx.Error(404)
return
}
err = ctx.Org.Team.RemoveMember(uid)
page = "team"
case "add":
if !ctx.Org.IsOwner {
ctx.Error(404)
return
}
uname := ctx.Query("uname")
var u *models.User
u, err = models.GetUserByName(uname)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Flash.Error(ctx.Tr("form.user_not_exist"))
ctx.Redirect(ctx.Org.OrgLink + "/teams/" + ctx.Org.Team.LowerName)
} else {
ctx.Handle(500, " GetUserByName", err)
}
return
}
err = ctx.Org.Team.AddMember(u.Id)
page = "team"
}
if err != nil {
if models.IsErrLastOrgOwner(err) {
ctx.Flash.Error(ctx.Tr("form.last_org_owner"))
} else {
log.Error(3, "Action(%s): %v", ctx.Params(":action"), err)
ctx.JSON(200, map[string]interface{}{
"ok": false,
"err": err.Error(),
})
return
}
}
switch page {
case "team":
ctx.Redirect(ctx.Org.OrgLink + "/teams/" + ctx.Org.Team.LowerName)
default:
ctx.Redirect(ctx.Org.OrgLink + "/teams")
}
}
func Dashboard(ctx *middleware.Context) {
ctx.Data["Title"] = ctx.Tr("dashboard")
ctx.Data["PageIsDashboard"] = true
ctx.Data["PageIsNews"] = true
ctxUser := getDashboardContextUser(ctx)
if ctx.Written() {
return
}
// Check context type.
if !ctxUser.IsOrganization() {
// Normal user.
ctxUser = ctx.User
collaborates, err := ctx.User.GetAccessibleRepositories()
if err != nil {
ctx.Handle(500, "GetAccessibleRepositories", err)
return
}
repositories := make([]*models.Repository, 0, len(collaborates))
for repo := range collaborates {
repositories = append(repositories, repo)
}
ctx.Data["CollaborateCount"] = len(repositories)
ctx.Data["CollaborativeRepos"] = repositories
}
repos, err := models.GetRepositories(ctxUser.Id, true)
if err != nil {
ctx.Handle(500, "GetRepositories", err)
return
}
ctx.Data["Repos"] = repos
// Get mirror repositories.
mirrors := make([]*models.Repository, 0, len(repos)/2)
for _, repo := range repos {
if repo.IsMirror {
if err = repo.GetMirror(); err != nil {
ctx.Handle(500, "GetMirror: "+repo.Name, err)
return
}
mirrors = append(mirrors, repo)
}
}
ctx.Data["MirrorCount"] = len(mirrors)
ctx.Data["Mirrors"] = mirrors
// Get feeds.
actions, err := models.GetFeeds(ctxUser.Id, 0, false)
if err != nil {
ctx.Handle(500, "GetFeeds", err)
return
}
// Check access of private repositories.
feeds := make([]*models.Action, 0, len(actions))
for _, act := range actions {
if act.IsPrivate {
// This prevents having to retrieve the repository for each action
repo := &models.Repository{ID: act.RepoID, IsPrivate: true}
if act.RepoUserName != ctx.User.LowerName {
if has, _ := models.HasAccess(ctx.User, repo, models.ACCESS_MODE_READ); !has {
continue
}
}
}
// FIXME: cache results?
u, err := models.GetUserByName(act.ActUserName)
if err != nil {
if models.IsErrUserNotExist(err) {
continue
}
ctx.Handle(500, "GetUserByName", err)
return
}
act.ActAvatar = u.AvatarLink()
feeds = append(feeds, act)
}
ctx.Data["Feeds"] = feeds
ctx.HTML(200, DASHBOARD)
}
func Profile(ctx *middleware.Context) {
ctx.Data["Title"] = "Profile"
ctx.Data["PageIsUserProfile"] = true
uname := ctx.Params(":username")
// Special handle for FireFox requests favicon.ico.
if uname == "favicon.ico" {
ctx.Redirect(setting.AppSubUrl + "/img/favicon.png")
return
}
isShowKeys := false
if strings.HasSuffix(uname, ".keys") {
isShowKeys = true
uname = strings.TrimSuffix(uname, ".keys")
}
u, err := models.GetUserByName(uname)
if err != nil {
if models.IsErrUserNotExist(err) {
ctx.Handle(404, "GetUserByName", err)
} else {
ctx.Handle(500, "GetUserByName", err)
}
return
}
// Show SSH keys.
if isShowKeys {
ShowSSHKeys(ctx, u.Id)
return
}
if u.IsOrganization() {
ctx.Redirect(setting.AppSubUrl + "/org/" + u.Name)
return
}
ctx.Data["Owner"] = u
tab := ctx.Query("tab")
ctx.Data["TabName"] = tab
switch tab {
case "activity":
actions, err := models.GetFeeds(u.Id, 0, false)
if err != nil {
ctx.Handle(500, "GetFeeds", err)
return
}
feeds := make([]*models.Action, 0, len(actions))
for _, act := range actions {
if act.IsPrivate {
if !ctx.IsSigned {
continue
}
// This prevents having to retrieve the repository for each action
repo := &models.Repository{ID: act.RepoID, IsPrivate: true}
if act.RepoUserName != ctx.User.LowerName {
if has, _ := models.HasAccess(ctx.User, repo, models.ACCESS_MODE_READ); !has {
continue
}
}
}
// FIXME: cache results?
u, err := models.GetUserByName(act.ActUserName)
if err != nil {
if models.IsErrUserNotExist(err) {
continue
}
ctx.Handle(500, "GetUserByName", err)
return
}
act.ActAvatar = u.AvatarLink()
feeds = append(feeds, act)
}
ctx.Data["Feeds"] = feeds
default:
ctx.Data["Repos"], err = models.GetRepositories(u.Id, ctx.IsSigned && ctx.User.Id == u.Id)
if err != nil {
ctx.Handle(500, "GetRepositories", err)
return
}
}
ctx.HTML(200, PROFILE)
}