diff --git a/conf/app.ini b/conf/app.ini index 0f6163c4f..8f076d126 100644 --- a/conf/app.ini +++ b/conf/app.ini @@ -24,6 +24,8 @@ PULL_REQUEST_QUEUE_LENGTH = 1000 ; Preferred Licenses to place at the top of the List ; Name must match file name in conf/license or custom/conf/license PREFERRED_LICENSES = Apache License 2.0,MIT License +; Disable ability to interact with repositories by HTTP protocol +DISABLE_HTTP_GIT = false [repository.editor] ; List of file extensions that should have line wraps in the CodeMirror editor diff --git a/modules/context/repo.go b/modules/context/repo.go index 0e883cc68..8dadf3a1e 100644 --- a/modules/context/repo.go +++ b/modules/context/repo.go @@ -254,6 +254,7 @@ func RepoAssignment(args ...bool) macaron.Handler { ctx.Data["IsRepositoryWriter"] = ctx.Repo.IsWriter() ctx.Data["DisableSSH"] = setting.SSH.Disabled + ctx.Data["DisableHTTP"] = setting.Repository.DisableHTTPGit ctx.Data["CloneLink"] = repo.CloneLink() ctx.Data["WikiCloneLink"] = repo.WikiCloneLink() diff --git a/modules/setting/setting.go b/modules/setting/setting.go index c2e4f43a1..923c45674 100644 --- a/modules/setting/setting.go +++ b/modules/setting/setting.go @@ -117,6 +117,7 @@ var ( MirrorQueueLength int PullRequestQueueLength int PreferredLicenses []string + DisableHTTPGit bool // Repository editor settings Editor struct { @@ -491,6 +492,7 @@ func NewContext() { // Determine and create root git repository path. sec = Cfg.Section("repository") + Repository.DisableHTTPGit = sec.Key("DISABLE_HTTP_GIT").MustBool() RepoRootPath = sec.Key("ROOT").MustString(path.Join(homeDir, "gogs-repositories")) forcePathSeparator(RepoRootPath) if !filepath.IsAbs(RepoRootPath) { diff --git a/routers/repo/http.go b/routers/repo/http.go index 36e53008d..529dc3d34 100644 --- a/routers/repo/http.go +++ b/routers/repo/http.go @@ -479,6 +479,11 @@ func HTTPBackend(ctx *context.Context, cfg *serviceConfig) http.HandlerFunc { for _, route := range routes { r.URL.Path = strings.ToLower(r.URL.Path) // blue: In case some repo name has upper case name if m := route.reg.FindStringSubmatch(r.URL.Path); m != nil { + if setting.Repository.DisableHTTPGit { + w.WriteHeader(http.StatusForbidden) + w.Write([]byte("Interacting with repositories by HTTP protocol is not allowed")) + return + } if route.method != r.Method { if r.Proto == "HTTP/1.1" { w.WriteHeader(http.StatusMethodNotAllowed) diff --git a/templates/repo/bare.tmpl b/templates/repo/bare.tmpl index 63baea16a..af45e672c 100644 --- a/templates/repo/bare.tmpl +++ b/templates/repo/bare.tmpl @@ -16,15 +16,21 @@