// Query if name/passwd can login against the LDAP directory pool // Create a local user if success // Return the same LoginUserPlain semantic // FIXME: https://github.com/gogits/gogs/issues/672 func LoginUserLdapSource(u *User, name, passwd string, sourceId int64, cfg *LDAPConfig, autoRegister bool) (*User, error) { name, fn, sn, mail, logged := cfg.Ldapsource.SearchEntry(name, passwd) if !logged { // User not in LDAP, do nothing return nil, ErrUserNotExist } if !autoRegister { return u, nil } // Fallback. if len(mail) == 0 { mail = uuid.NewV4().String() + "@localhost" } u = &User{ LowerName: strings.ToLower(name), Name: name, FullName: fn + " " + sn, LoginType: LDAP, LoginSource: sourceId, LoginName: name, Passwd: passwd, Email: mail, IsActive: true, } return u, CreateUser(u) }
// NewAttachment creates a new attachment object. func NewAttachment(name string, buf []byte, file multipart.File) (_ *Attachment, err error) { attach := &Attachment{ UUID: gouuid.NewV4().String(), Name: name, } if err = os.MkdirAll(path.Dir(attach.LocalPath()), os.ModePerm); err != nil { return nil, fmt.Errorf("MkdirAll: %v", err) } fw, err := os.Create(attach.LocalPath()) if err != nil { return nil, fmt.Errorf("Create: %v", err) } defer fw.Close() if _, err = fw.Write(buf); err != nil { return nil, fmt.Errorf("Write: %v", err) } else if _, err = io.Copy(fw, file); err != nil { return nil, fmt.Errorf("Copy: %v", err) } sess := x.NewSession() defer sessionRelease(sess) if err := sess.Begin(); err != nil { return nil, err } if _, err := sess.Insert(attach); err != nil { return nil, err } return attach, sess.Commit() }
// CreateHookTask creates a new hook task, // it handles conversion from Payload to PayloadContent. func CreateHookTask(t *HookTask) error { data, err := t.BasePayload.GetJSONPayload() if err != nil { return err } t.Uuid = uuid.NewV4().String() t.PayloadContent = string(data) _, err = x.Insert(t) return err }
// CreateHookTask creates a new hook task, // it handles conversion from Payload to PayloadContent. func CreateHookTask(t *HookTask) error { data, err := json.Marshal(t.Payload) if err != nil { return err } t.Uuid = uuid.NewV4().String() t.PayloadContent = string(data) _, err = x.Insert(t) return err }
func attachmentRefactor(x *xorm.Engine) error { type Attachment struct { ID int64 `xorm:"pk autoincr"` UUID string `xorm:"uuid INDEX"` // For rename purpose. Path string `xorm:"-"` NewPath string `xorm:"-"` } results, err := x.Query("SELECT * FROM `attachment`") if err != nil { return fmt.Errorf("select attachments: %v", err) } attachments := make([]*Attachment, 0, len(results)) for _, attach := range results { if !com.IsExist(string(attach["path"])) { // If the attachment is already missing, there is no point to update it. continue } attachments = append(attachments, &Attachment{ ID: com.StrTo(attach["id"]).MustInt64(), UUID: gouuid.NewV4().String(), Path: string(attach["path"]), }) } sess := x.NewSession() defer sessionRelease(sess) if err = sess.Begin(); err != nil { return err } if err = sess.Sync2(new(Attachment)); err != nil { return fmt.Errorf("Sync2: %v", err) } // Note: Roll back for rename can be a dead loop, // so produces a backup file. var buf bytes.Buffer buf.WriteString("# old path -> new path\n") // Update database first because this is where error happens the most often. for _, attach := range attachments { if _, err = sess.Id(attach.ID).Update(attach); err != nil { return err } attach.NewPath = path.Join(setting.AttachmentPath, attach.UUID[0:1], attach.UUID[1:2], attach.UUID) buf.WriteString(attach.Path) buf.WriteString("\t") buf.WriteString(attach.NewPath) buf.WriteString("\n") } // Then rename attachments. isSucceed := true defer func() { if isSucceed { return } dumpPath := path.Join(setting.LogRootPath, "attachment_path.dump") ioutil.WriteFile(dumpPath, buf.Bytes(), 0666) fmt.Println("Fail to rename some attachments, old and new paths are saved into:", dumpPath) }() for _, attach := range attachments { if err = os.MkdirAll(path.Dir(attach.NewPath), os.ModePerm); err != nil { isSucceed = false return err } if err = os.Rename(attach.Path, attach.NewPath); err != nil { isSucceed = false return err } } return sess.Commit() }
func runServ(c *cli.Context) { if c.IsSet("config") { setting.CustomConf = c.String("config") } setup("serv.log") if len(c.Args()) < 1 { fail("Not enough arguments", "Not enough arguments") } cmd := os.Getenv("SSH_ORIGINAL_COMMAND") if len(cmd) == 0 { println("Hi there, You've successfully authenticated, but Gogs does not provide shell access.") println("If this is unexpected, please log in with password and setup Gogs under another user.") return } verb, args := parseCmd(cmd) repoPath := strings.ToLower(strings.Trim(args, "'")) rr := strings.SplitN(repoPath, "/", 2) if len(rr) != 2 { fail("Invalid repository path", "Invalid repository path: %v", args) } username := strings.ToLower(rr[0]) reponame := strings.ToLower(strings.TrimSuffix(rr[1], ".git")) isWiki := false if strings.HasSuffix(reponame, ".wiki") { isWiki = true reponame = reponame[:len(reponame)-5] } repoUser, err := models.GetUserByName(username) if err != nil { if models.IsErrUserNotExist(err) { fail("Repository owner does not exist", "Unregistered owner: %s", username) } fail("Internal error", "Failed to get repository owner (%s): %v", username, err) } repo, err := models.GetRepositoryByName(repoUser.Id, reponame) if err != nil { if models.IsErrRepoNotExist(err) { fail(_ACCESS_DENIED_MESSAGE, "Repository does not exist: %s/%s", repoUser.Name, reponame) } fail("Internal error", "Failed to get repository: %v", err) } requestedMode, has := allowedCommands[verb] if !has { fail("Unknown git command", "Unknown git command %s", verb) } // Prohibit push to mirror repositories. if requestedMode > models.ACCESS_MODE_READ && repo.IsMirror { fail("mirror repository is read-only", "") } // Allow anonymous clone for public repositories. var ( keyID int64 user *models.User ) if requestedMode == models.ACCESS_MODE_WRITE || repo.IsPrivate { keys := strings.Split(c.Args()[0], "-") if len(keys) != 2 { fail("Key ID format error", "Invalid key argument: %s", c.Args()[0]) } key, err := models.GetPublicKeyByID(com.StrTo(keys[1]).MustInt64()) if err != nil { fail("Invalid key ID", "Invalid key ID[%s]: %v", c.Args()[0], err) } keyID = key.ID // Check deploy key or user key. if key.Type == models.KEY_TYPE_DEPLOY { if key.Mode < requestedMode { fail("Key permission denied", "Cannot push with deployment key: %d", key.ID) } // Check if this deploy key belongs to current repository. if !models.HasDeployKey(key.ID, repo.ID) { fail("Key access denied", "Deploy key access denied: [key_id: %d, repo_id: %d]", key.ID, repo.ID) } // Update deploy key activity. deployKey, err := models.GetDeployKeyByRepo(key.ID, repo.ID) if err != nil { fail("Internal error", "GetDeployKey: %v", err) } deployKey.Updated = time.Now() if err = models.UpdateDeployKey(deployKey); err != nil { fail("Internal error", "UpdateDeployKey: %v", err) } } else { user, err = models.GetUserByKeyID(key.ID) if err != nil { fail("internal error", "Failed to get user by key ID(%d): %v", keyID, err) } mode, err := models.AccessLevel(user, repo) if err != nil { fail("Internal error", "Fail to check access: %v", err) } else if mode < requestedMode { clientMessage := _ACCESS_DENIED_MESSAGE if mode >= models.ACCESS_MODE_READ { clientMessage = "You do not have sufficient authorization for this action" } fail(clientMessage, "User %s does not have level %v access to repository %s", user.Name, requestedMode, repoPath) } } } uuid := uuid.NewV4().String() os.Setenv("uuid", uuid) // Special handle for Windows. if setting.IsWindows { verb = strings.Replace(verb, "-", " ", 1) } var gitcmd *exec.Cmd verbs := strings.Split(verb, " ") if len(verbs) == 2 { gitcmd = exec.Command(verbs[0], verbs[1], repoPath) } else { gitcmd = exec.Command(verb, repoPath) } gitcmd.Dir = setting.RepoRootPath gitcmd.Stdout = os.Stdout gitcmd.Stdin = os.Stdin gitcmd.Stderr = os.Stderr if err = gitcmd.Run(); err != nil { fail("Internal error", "Failed to execute git command: %v", err) } if requestedMode == models.ACCESS_MODE_WRITE { handleUpdateTask(uuid, user, repoUser, reponame, isWiki) } // Update user key activity. if keyID > 0 { key, err := models.GetPublicKeyByID(keyID) if err != nil { fail("Internal error", "GetPublicKeyById: %v", err) } key.Updated = time.Now() if err = models.UpdatePublicKey(key); err != nil { fail("Internal error", "UpdatePublicKey: %v", err) } } }
// NewAccessToken creates new access token. func NewAccessToken(t *AccessToken) error { t.Sha1 = base.EncodeSha1(uuid.NewV4().String()) _, err := x.Insert(t) return err }
func runServ(c *cli.Context) { if c.IsSet("config") { setting.CustomConf = c.String("config") } setup("serv.log") fail := func(userMessage, logMessage string, args ...interface{}) { fmt.Fprintln(os.Stderr, "Gogs: ", userMessage) log.GitLogger.Fatal(2, logMessage, args...) } if len(c.Args()) < 1 { fail("Not enough arguments", "Not enough arugments") } keys := strings.Split(c.Args()[0], "-") if len(keys) != 2 { fail("key-id format error", "Invalid key id: %s", c.Args()[0]) } keyId, err := com.StrTo(keys[1]).Int64() if err != nil { fail("key-id format error", "Invalid key id: %s", err) } user, err := models.GetUserByKeyId(keyId) if err != nil { fail("internal error", "Fail to get user by key ID(%d): %v", keyId, err) } cmd := os.Getenv("SSH_ORIGINAL_COMMAND") if cmd == "" { fmt.Printf("Hi, %s! You've successfully authenticated, but Gogs does not provide shell access.\n", user.Name) if user.IsAdmin { println("If this is unexpected, please log in with password and setup Gogs under another user.") } return } verb, args := parseCmd(cmd) repoPath := strings.Trim(args, "'") rr := strings.SplitN(repoPath, "/", 2) if len(rr) != 2 { fail("Invalid repository path", "Invalide repository path: %v", args) } repoUserName := rr[0] repoName := strings.TrimSuffix(rr[1], ".git") repoUser, err := models.GetUserByName(repoUserName) if err != nil { if err == models.ErrUserNotExist { fail("Repository owner does not exist", "Unregistered owner: %s", repoUserName) } fail("Internal error", "Fail to get repository owner(%s): %v", repoUserName, err) } repo, err := models.GetRepositoryByName(repoUser.Id, repoName) if err != nil { if models.IsErrRepoNotExist(err) { if user.Id == repoUser.Id || repoUser.IsOwnedBy(user.Id) { fail("Repository does not exist", "Repository does not exist: %s/%s", repoUser.Name, repoName) } else { fail(_ACCESS_DENIED_MESSAGE, "Repository does not exist: %s/%s", repoUser.Name, repoName) } } fail("Internal error", "Fail to get repository: %v", err) } requestedMode, has := COMMANDS[verb] if !has { fail("Unknown git command", "Unknown git command %s", verb) } mode, err := models.AccessLevel(user, repo) if err != nil { fail("Internal error", "Fail to check access: %v", err) } else if mode < requestedMode { clientMessage := _ACCESS_DENIED_MESSAGE if mode >= models.ACCESS_MODE_READ { clientMessage = "You do not have sufficient authorization for this action" } fail(clientMessage, "User %s does not have level %v access to repository %s", user.Name, requestedMode, repoPath) } uuid := uuid.NewV4().String() os.Setenv("uuid", uuid) var gitcmd *exec.Cmd verbs := strings.Split(verb, " ") if len(verbs) == 2 { gitcmd = exec.Command(verbs[0], verbs[1], repoPath) } else { gitcmd = exec.Command(verb, repoPath) } gitcmd.Dir = setting.RepoRootPath gitcmd.Stdout = os.Stdout gitcmd.Stdin = os.Stdin gitcmd.Stderr = os.Stderr if err = gitcmd.Run(); err != nil { fail("Internal error", "Fail to execute git command: %v", err) } if requestedMode == models.ACCESS_MODE_WRITE { tasks, err := models.GetUpdateTasksByUuid(uuid) if err != nil { log.GitLogger.Fatal(2, "GetUpdateTasksByUuid: %v", err) } for _, task := range tasks { err = models.Update(task.RefName, task.OldCommitId, task.NewCommitId, user.Name, repoUserName, repoName, user.Id) if err != nil { log.GitLogger.Error(2, "Fail to update: %v", err) } } if err = models.DelUpdateTasksByUuid(uuid); err != nil { log.GitLogger.Fatal(2, "DelUpdateTasksByUuid: %v", err) } } // Update key activity. key, err := models.GetPublicKeyById(keyId) if err != nil { fail("Internal error", "GetPublicKeyById: %v", err) } key.Updated = time.Now() if err = models.UpdatePublicKey(key); err != nil { fail("Internal error", "UpdatePublicKey: %v", err) } }
func runServ(k *cli.Context) { setup("serv.log") keys := strings.Split(os.Args[2], "-") if len(keys) != 2 { println("Gogs: auth file format error") log.GitLogger.Fatal(2, "Invalid auth file format: %s", os.Args[2]) } keyId, err := com.StrTo(keys[1]).Int64() if err != nil { println("Gogs: auth file format error") log.GitLogger.Fatal(2, "Invalid auth file format: %v", err) } user, err := models.GetUserByKeyId(keyId) if err != nil { if err == models.ErrUserNotKeyOwner { println("Gogs: you are not the owner of SSH key") log.GitLogger.Fatal(2, "Invalid owner of SSH key: %d", keyId) } println("Gogs: internal error:", err) log.GitLogger.Fatal(2, "Fail to get user by key ID(%d): %v", keyId, err) } cmd := os.Getenv("SSH_ORIGINAL_COMMAND") if cmd == "" { println("Hi", user.Name, "! You've successfully authenticated, but Gogs does not provide shell access.") return } verb, args := parseCmd(cmd) repoPath := strings.Trim(args, "'") rr := strings.SplitN(repoPath, "/", 2) if len(rr) != 2 { println("Gogs: unavailable repository", args) log.GitLogger.Fatal(2, "Unavailable repository: %v", args) } repoUserName := rr[0] repoName := strings.TrimSuffix(rr[1], ".git") isWrite := In(verb, COMMANDS_WRITE) isRead := In(verb, COMMANDS_READONLY) repoUser, err := models.GetUserByName(repoUserName) if err != nil { if err == models.ErrUserNotExist { println("Gogs: given repository owner are not registered") log.GitLogger.Fatal(2, "Unregistered owner: %s", repoUserName) } println("Gogs: internal error:", err) log.GitLogger.Fatal(2, "Fail to get repository owner(%s): %v", repoUserName, err) } // Access check. switch { case isWrite: has, err := models.HasAccess(user.Name, path.Join(repoUserName, repoName), models.WRITABLE) if err != nil { println("Gogs: internal error:", err) log.GitLogger.Fatal(2, "Fail to check write access:", err) } else if !has { println("You have no right to write this repository") log.GitLogger.Fatal(2, "User %s has no right to write repository %s", user.Name, repoPath) } case isRead: repo, err := models.GetRepositoryByName(repoUser.Id, repoName) if err != nil { if err == models.ErrRepoNotExist { println("Gogs: given repository does not exist") log.GitLogger.Fatal(2, "Repository does not exist: %s/%s", repoUser.Name, repoName) } println("Gogs: internal error:", err) log.GitLogger.Fatal(2, "Fail to get repository: %v", err) } if !repo.IsPrivate { break } has, err := models.HasAccess(user.Name, path.Join(repoUserName, repoName), models.READABLE) if err != nil { println("Gogs: internal error:", err) log.GitLogger.Fatal(2, "Fail to check read access:", err) } else if !has { println("You have no right to access this repository") log.GitLogger.Fatal(2, "User %s has no right to read repository %s", user.Name, repoPath) } default: println("Unknown command") return } uuid := uuid.NewV4().String() os.Setenv("uuid", uuid) gitcmd := exec.Command(verb, repoPath) gitcmd.Dir = setting.RepoRootPath gitcmd.Stdout = os.Stdout gitcmd.Stdin = os.Stdin gitcmd.Stderr = os.Stderr if err = gitcmd.Run(); err != nil { println("Gogs: internal error:", err.Error()) log.GitLogger.Fatal(2, "Fail to execute git command: %v", err) } if isWrite { tasks, err := models.GetUpdateTasksByUuid(uuid) if err != nil { log.GitLogger.Fatal(2, "GetUpdateTasksByUuid: %v", err) } for _, task := range tasks { err = models.Update(task.RefName, task.OldCommitId, task.NewCommitId, user.Name, repoUserName, repoName, user.Id) if err != nil { log.GitLogger.Error(2, "Fail to update: %v", err) } } if err = models.DelUpdateTasksByUuid(uuid); err != nil { log.GitLogger.Fatal(2, "DelUpdateTasksByUuid: %v", err) } } // Update key activity. key, err := models.GetPublicKeyById(keyId) if err != nil { log.GitLogger.Fatal(2, "GetPublicKeyById: %v", err) } key.Updated = time.Now() if err = models.UpdatePublicKey(key); err != nil { log.GitLogger.Fatal(2, "UpdatePublicKey: %v", err) } }
// SignedInUser returns the user object of signed user. // It returns a bool value to indicate whether user uses basic auth or not. func SignedInUser(ctx *macaron.Context, sess session.Store) (*models.User, bool) { if !models.HasEngine { return nil, false } uid := SignedInID(ctx, sess) if uid <= 0 { if setting.Service.EnableReverseProxyAuth { webAuthUser := ctx.Req.Header.Get(setting.ReverseProxyAuthUser) if len(webAuthUser) > 0 { u, err := models.GetUserByName(webAuthUser) if err != nil { if !models.IsErrUserNotExist(err) { log.Error(4, "GetUserByName: %v", err) return nil, false } // Check if enabled auto-registration. if setting.Service.EnableReverseProxyAutoRegister { u := &models.User{ Name: webAuthUser, Email: uuid.NewV4().String() + "@localhost", Passwd: webAuthUser, IsActive: true, } if err = models.CreateUser(u); err != nil { // FIXME: should I create a system notice? log.Error(4, "CreateUser: %v", err) return nil, false } else { return u, false } } } return u, false } } // Check with basic auth. baHead := ctx.Req.Header.Get("Authorization") if len(baHead) > 0 { auths := strings.Fields(baHead) if len(auths) == 2 && auths[0] == "Basic" { uname, passwd, _ := base.BasicAuthDecode(auths[1]) u, err := models.UserSignIn(uname, passwd) if err != nil { if !models.IsErrUserNotExist(err) { log.Error(4, "UserSignIn: %v", err) } return nil, false } return u, true } } return nil, false } u, err := models.GetUserByID(uid) if err != nil { log.Error(4, "GetUserById: %v", err) return nil, false } return u, false }
func runServ(c *cli.Context) { if c.IsSet("config") { setting.CustomConf = c.String("config") } setup("serv.log") if len(c.Args()) < 1 { fail("Not enough arguments", "Not enough arguments") } cmd := os.Getenv("SSH_ORIGINAL_COMMAND") if len(cmd) == 0 { println("Hi there, You've successfully authenticated, but Gogs does not provide shell access.") println("If this is unexpected, please log in with password and setup Gogs under another user.") return } verb, args := parseCmd(cmd) repoPath := strings.Trim(args, "'") rr := strings.SplitN(repoPath, "/", 2) if len(rr) != 2 { fail("Invalid repository path", "Invalid repository path: %v", args) } repoUserName := rr[0] repoName := strings.TrimSuffix(rr[1], ".git") repoUser, err := models.GetUserByName(repoUserName) if err != nil { if models.IsErrUserNotExist(err) { fail("Repository owner does not exist", "Unregistered owner: %s", repoUserName) } fail("Internal error", "Failed to get repository owner(%s): %v", repoUserName, err) } repo, err := models.GetRepositoryByName(repoUser.Id, repoName) if err != nil { if models.IsErrRepoNotExist(err) { fail(_ACCESS_DENIED_MESSAGE, "Repository does not exist: %s/%s", repoUser.Name, repoName) } fail("Internal error", "Failed to get repository: %v", err) } requestedMode, has := COMMANDS[verb] if !has { fail("Unknown git command", "Unknown git command %s", verb) } // Allow anonymous clone for public repositories. var ( keyID int64 user *models.User ) if requestedMode == models.ACCESS_MODE_WRITE || repo.IsPrivate { keys := strings.Split(c.Args()[0], "-") if len(keys) != 2 { fail("Key ID format error", "Invalid key ID: %s", c.Args()[0]) } key, err := models.GetPublicKeyByID(com.StrTo(keys[1]).MustInt64()) if err != nil { fail("Key ID format error", "Invalid key ID[%s]: %v", c.Args()[0], err) } keyID = key.ID // Check deploy key or user key. if key.Type == models.KEY_TYPE_DEPLOY { if key.Mode < requestedMode { fail("Key permission denied", "Cannot push with deployment key: %d", key.ID) } // Check if this deploy key belongs to current repository. if !models.HasDeployKey(key.ID, repo.ID) { fail("Key access denied", "Key access denied: %d-%d", key.ID, repo.ID) } // Update deploy key activity. deployKey, err := models.GetDeployKeyByRepo(key.ID, repo.ID) if err != nil { fail("Internal error", "GetDeployKey: %v", err) } deployKey.Updated = time.Now() if err = models.UpdateDeployKey(deployKey); err != nil { fail("Internal error", "UpdateDeployKey: %v", err) } } else { user, err = models.GetUserByKeyId(key.ID) if err != nil { fail("internal error", "Failed to get user by key ID(%d): %v", keyID, err) } mode, err := models.AccessLevel(user, repo) if err != nil { fail("Internal error", "Fail to check access: %v", err) } else if mode < requestedMode { clientMessage := _ACCESS_DENIED_MESSAGE if mode >= models.ACCESS_MODE_READ { clientMessage = "You do not have sufficient authorization for this action" } fail(clientMessage, "User %s does not have level %v access to repository %s", user.Name, requestedMode, repoPath) } } } uuid := uuid.NewV4().String() os.Setenv("uuid", uuid) var gitcmd *exec.Cmd verbs := strings.Split(verb, " ") if len(verbs) == 2 { gitcmd = exec.Command(verbs[0], verbs[1], repoPath) } else { gitcmd = exec.Command(verb, repoPath) } gitcmd.Dir = setting.RepoRootPath gitcmd.Stdout = os.Stdout gitcmd.Stdin = os.Stdin gitcmd.Stderr = os.Stderr if err = gitcmd.Run(); err != nil { fail("Internal error", "Failed to execute git command: %v", err) } if requestedMode == models.ACCESS_MODE_WRITE { tasks, err := models.GetUpdateTasksByUuid(uuid) if err != nil { log.GitLogger.Fatal(2, "GetUpdateTasksByUuid: %v", err) } for _, task := range tasks { err = models.Update(task.RefName, task.OldCommitId, task.NewCommitId, user.Name, repoUserName, repoName, user.Id) if err != nil { log.GitLogger.Error(2, "Failed to update: %v", err) } } if err = models.DelUpdateTasksByUuid(uuid); err != nil { log.GitLogger.Fatal(2, "DelUpdateTasksByUuid: %v", err) } } // Send deliver hook request. resp, err := httplib.Head(setting.AppUrl + setting.AppSubUrl + repoUserName + "/" + repoName + "/hooks/trigger").Response() if err == nil { resp.Body.Close() } // Update user key activity. if keyID > 0 { key, err := models.GetPublicKeyByID(keyID) if err != nil { fail("Internal error", "GetPublicKeyById: %v", err) } key.Updated = time.Now() if err = models.UpdatePublicKey(key); err != nil { fail("Internal error", "UpdatePublicKey: %v", err) } } }