opendev/gerrit
Code Issues Proposed changes

Configure All-Users to protect read of the refs/users/* namespace

Browse Source 
Assume user preferences should not be public and protect the
contents from any client.

Change-Id: I07b343d929ec3facb7724b476ad54722a0f9be80
This commit is contained in:
Shawn Pearce
2014-03-27 08:40:57 -07:00
parent eb206dfab5
commit 381617e23f
1 changed files with 37 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
gerrit-server/src/main/java/com/google/gerrit/server/schema/AllUsersCreator.java
View File

@@ -14,12 +14,22 @@
package com.google.gerrit.server.schema;
import com.google.gerrit.common.Version;
import com.google.gerrit.common.data.AccessSection;
import com.google.gerrit.common.data.Permission;
import com.google.gerrit.reviewdb.client.Project;
import com.google.gerrit.reviewdb.client.RefNames;
import com.google.gerrit.server.GerritPersonIdent;
import com.google.gerrit.server.config.AllUsersName;
import com.google.gerrit.server.extensions.events.GitReferenceUpdated;
import com.google.gerrit.server.git.GitRepositoryManager;
import com.google.gerrit.server.git.MetaDataUpdate;
import com.google.gerrit.server.git.ProjectConfig;
import com.google.inject.Inject;
import org.eclipse.jgit.errors.ConfigInvalidException;
import org.eclipse.jgit.errors.RepositoryNotFoundException;
import org.eclipse.jgit.lib.PersonIdent;
import org.eclipse.jgit.lib.Repository;
import java.io.IOException;
@@ -28,20 +38,27 @@ import java.io.IOException;
public class AllUsersCreator {
private final GitRepositoryManager mgr;
private final AllUsersName allUsersName;
private final PersonIdent serverUser;
@Inject
AllUsersCreator(GitRepositoryManager mgr, AllUsersName allUsersName) {
AllUsersCreator(
GitRepositoryManager mgr,
AllUsersName allUsersName,
@GerritPersonIdent PersonIdent serverUser) {
this.mgr = mgr;
this.allUsersName = allUsersName;
this.serverUser = serverUser;
}
public void create() throws IOException, ConfigInvalidException {
Repository git = null;
try {
git = mgr.openRepository(allUsersName);
initAllUsers(git);
} catch (RepositoryNotFoundException notFound) {
try {
git = mgr.createRepository(allUsersName);
initAllUsers(git);
} catch (RepositoryNotFoundException err) {
String name = allUsersName.get();
throw new IOException("Cannot create repository " + name, err);
@@ -52,4 +69,23 @@ public class AllUsersCreator {
}
}
}
private void initAllUsers(Repository git)
throws IOException, ConfigInvalidException {
MetaDataUpdate md = new MetaDataUpdate(
GitReferenceUpdated.DISABLED,
allUsersName,
git);
md.getCommitBuilder().setAuthor(serverUser);
md.getCommitBuilder().setCommitter(serverUser);
md.setMessage("Initialized Gerrit Code Review " + Version.getVersion());
ProjectConfig config = ProjectConfig.read(md);
Project project = config.getProject();
project.setDescription("Individual user settings and preferences.");
AccessSection all = config.getAccessSection(RefNames.REFS_USER + "*", true);
all.getPermission(Permission.READ, true).setExclusiveGroup(true);
config.commit(md);
}
}