From 488d34691ad79bae13320f3e831a7ff46c245a89 Mon Sep 17 00:00:00 2001
From: "James E. Blair" <corvus@inaugust.com>
Date: Tue, 14 May 2019 07:40:27 -0700
Subject: [PATCH] Ignore non-standard refs in git push (#6758)

When replicating to gitea from a remote system which makes use of
git refs to store extra data (for example, gerrit), pushing a lot
of refs to gitea can cause problems due to the extra processing
that the pre and post receive hooks perform.  But it's still
useful for gitea to be able to serve those refs.  This change
skips unecessary processing of refs other than branches or tags.

We don't need to check any ref that isn't a branch for branch
protection (protection will never be enabled).  So in the
pre-receive hook, we wrap that check in a test for whether the
ref is a branch.

We also don't need to add information to the activity stream about
pushes to non-standard refs, so we skip that step in the
post-receive hook for refs which are not branches or tags.

For some concrete examples, gerrit maintains a ref for every
patchset of every change in the form refs/changes/XX/YYYY/Z.
Many systems use refs/notes to store additonal data about commits.
This change allows these and other schemes to be used without
affecting gitea.
---
 cmd/hook.go | 83 +++++++++++++++++++++++++++++------------------------
 1 file changed, 46 insertions(+), 37 deletions(-)

diff --git a/cmd/hook.go b/cmd/hook.go
index 46f97d554..f8bd34c4e 100644
--- a/cmd/hook.go
+++ b/cmd/hook.go
@@ -89,34 +89,37 @@ func runHookPreReceive(c *cli.Context) error {
 		newCommitID := string(fields[1])
 		refFullName := string(fields[2])
 
-		branchName := strings.TrimPrefix(refFullName, git.BranchPrefix)
-		protectBranch, err := private.GetProtectedBranchBy(repoID, branchName)
-		if err != nil {
-			fail("Internal error", fmt.Sprintf("retrieve protected branches information failed: %v", err))
-		}
-
-		if protectBranch != nil && protectBranch.IsProtected() {
-			// check and deletion
-			if newCommitID == git.EmptySHA {
-				fail(fmt.Sprintf("branch %s is protected from deletion", branchName), "")
-			}
-
-			// detect force push
-			if git.EmptySHA != oldCommitID {
-				output, err := git.NewCommand("rev-list", "--max-count=1", oldCommitID, "^"+newCommitID).RunInDir(repoPath)
-				if err != nil {
-					fail("Internal error", "Fail to detect force push: %v", err)
-				} else if len(output) > 0 {
-					fail(fmt.Sprintf("branch %s is protected from force push", branchName), "")
-				}
-			}
-
-			userID, _ := strconv.ParseInt(userIDStr, 10, 64)
-			canPush, err := private.CanUserPush(protectBranch.ID, userID)
+		// If the ref is a branch, check if it's protected
+		if strings.HasPrefix(refFullName, git.BranchPrefix) {
+			branchName := strings.TrimPrefix(refFullName, git.BranchPrefix)
+			protectBranch, err := private.GetProtectedBranchBy(repoID, branchName)
 			if err != nil {
-				fail("Internal error", "Fail to detect user can push: %v", err)
-			} else if !canPush {
-				fail(fmt.Sprintf("protected branch %s can not be pushed to", branchName), "")
+				fail("Internal error", fmt.Sprintf("retrieve protected branches information failed: %v", err))
+			}
+
+			if protectBranch != nil && protectBranch.IsProtected() {
+				// check and deletion
+				if newCommitID == git.EmptySHA {
+					fail(fmt.Sprintf("branch %s is protected from deletion", branchName), "")
+				}
+
+				// detect force push
+				if git.EmptySHA != oldCommitID {
+					output, err := git.NewCommand("rev-list", "--max-count=1", oldCommitID, "^"+newCommitID).RunInDir(repoPath)
+					if err != nil {
+						fail("Internal error", "Fail to detect force push: %v", err)
+					} else if len(output) > 0 {
+						fail(fmt.Sprintf("branch %s is protected from force push", branchName), "")
+					}
+				}
+
+				userID, _ := strconv.ParseInt(userIDStr, 10, 64)
+				canPush, err := private.CanUserPush(protectBranch.ID, userID)
+				if err != nil {
+					fail("Internal error", "Fail to detect user can push: %v", err)
+				} else if !canPush {
+					fail(fmt.Sprintf("protected branch %s can not be pushed to", branchName), "")
+				}
 			}
 		}
 	}
@@ -169,16 +172,22 @@ func runHookPostReceive(c *cli.Context) error {
 		newCommitID := string(fields[1])
 		refFullName := string(fields[2])
 
-		if err := private.PushUpdate(models.PushUpdateOptions{
-			RefFullName:  refFullName,
-			OldCommitID:  oldCommitID,
-			NewCommitID:  newCommitID,
-			PusherID:     pusherID,
-			PusherName:   pusherName,
-			RepoUserName: repoUser,
-			RepoName:     repoName,
-		}); err != nil {
-			log.GitLogger.Error("Update: %v", err)
+		// Only trigger activity updates for changes to branches or
+		// tags.  Updates to other refs (eg, refs/notes, refs/changes,
+		// or other less-standard refs spaces are ignored since there
+		// may be a very large number of them).
+		if strings.HasPrefix(refFullName, git.BranchPrefix) || strings.HasPrefix(refFullName, git.TagPrefix) {
+			if err := private.PushUpdate(models.PushUpdateOptions{
+				RefFullName:  refFullName,
+				OldCommitID:  oldCommitID,
+				NewCommitID:  newCommitID,
+				PusherID:     pusherID,
+				PusherName:   pusherName,
+				RepoUserName: repoUser,
+				RepoName:     repoName,
+			}); err != nil {
+				log.GitLogger.Error("Update: %v", err)
+			}
 		}
 
 		if newCommitID != git.EmptySHA && strings.HasPrefix(refFullName, git.BranchPrefix) {