Skip to content

Commit 0b17757

Browse files
stklcodelunny
stklcode
authored and
lunny
committed
Only show SSH clone URL if signed in (#2169) (#2170)
* Add configuration flag SSH_EXPOSE_ANONYMOUS If this flag (default True) is set to false, the SSH clone URL will only be exposed if the current user is signed in. * Default SSH exposure set to false To match GitHub and for security reasons, SSH URL exposure is disabled by default. In addition to that. minor code changes have been applied. Signed-off-by: Stefan Kalscheuer <[email protected]> * Add integration tests * Hide clone button neither HTTP and SSH is enabled Signed-off-by: Stefan Kalscheuer <[email protected]>
1 parent 32f289a commit 0b17757

File tree

7 files changed

+61
-13
lines changed

7 files changed

+61
-13
lines changed

‎conf/app.ini

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ SSH_KEY_TEST_PATH =
126126
SSH_KEYGEN_PATH = ssh-keygen
127127
; Enable SSH Authorized Key Backup when rewriting all keys, default is true
128128
SSH_BACKUP_AUTHORIZED_KEYS = true
129+
; Enable exposure of SSH clone URL to anonymous visitors, default is false
130+
SSH_EXPOSE_ANONYMOUS = false
129131
; Indicate whether to check minimum key size with corresponding type
130132
MINIMUM_KEY_SIZE_CHECK = false
131133
; Disable CDN even in "prod" mode

‎integrations/repo_test.go

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,13 @@
55
package integrations
66

77
import (
8+
"fmt"
89
"net/http"
910
"testing"
11+
12+
"code.gitea.io/gitea/modules/setting"
13+
14+
"github.com/stretchr/testify/assert"
1015
)
1116

1217
func TestViewRepo(t *testing.T) {
@@ -37,3 +42,35 @@ func TestViewRepo3(t *testing.T) {
3742
session := loginUser(t, "user3")
3843
session.MakeRequest(t, req, http.StatusOK)
3944
}
45+
46+
func TestViewRepo1CloneLinkAnonymous(t *testing.T) {
47+
prepareTestEnv(t)
48+
49+
req := NewRequest(t, "GET", "/user2/repo1")
50+
resp := MakeRequest(t, req, http.StatusOK)
51+
52+
htmlDoc := NewHTMLParser(t, resp.Body)
53+
link, exists := htmlDoc.doc.Find("#repo-clone-https").Attr("data-link")
54+
assert.True(t, exists, "The template has changed")
55+
assert.Equal(t, setting.AppURL+"user2/repo1.git", link)
56+
_, exists = htmlDoc.doc.Find("#repo-clone-ssh").Attr("data-link")
57+
assert.False(t, exists)
58+
}
59+
60+
func TestViewRepo1CloneLinkAuthorized(t *testing.T) {
61+
prepareTestEnv(t)
62+
63+
session := loginUser(t, "user2")
64+
65+
req := NewRequest(t, "GET", "/user2/repo1")
66+
resp := session.MakeRequest(t, req, http.StatusOK)
67+
68+
htmlDoc := NewHTMLParser(t, resp.Body)
69+
link, exists := htmlDoc.doc.Find("#repo-clone-https").Attr("data-link")
70+
assert.True(t, exists, "The template has changed")
71+
assert.Equal(t, setting.AppURL+"user2/repo1.git", link)
72+
link, exists = htmlDoc.doc.Find("#repo-clone-ssh").Attr("data-link")
73+
assert.True(t, exists, "The template has changed")
74+
sshURL := fmt.Sprintf("%s@%s:user2/repo1.git", setting.RunUser, setting.SSH.Domain)
75+
assert.Equal(t, sshURL, link)
76+
}

‎modules/context/repo.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,7 @@ func RepoAssignment() macaron.Handler {
285285
ctx.Data["IsRepositoryWriter"] = ctx.Repo.IsWriter()
286286

287287
ctx.Data["DisableSSH"] = setting.SSH.Disabled
288+
ctx.Data["ExposeAnonSSH"] = setting.SSH.ExposeAnonymous
288289
ctx.Data["DisableHTTP"] = setting.Repository.DisableHTTPGit
289290
ctx.Data["CloneLink"] = repo.CloneLink()
290291
ctx.Data["WikiCloneLink"] = repo.WikiCloneLink()

‎modules/setting/setting.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,7 @@ var (
9999
AuthorizedKeysBackup bool `ini:"SSH_AUTHORIZED_KEYS_BACKUP"`
100100
MinimumKeySizeCheck bool `ini:"-"`
101101
MinimumKeySizes map[string]int `ini:"-"`
102+
ExposeAnonymous bool `ini:"SSH_EXPOSE_ANONYMOUS"`
102103
}{
103104
Disabled: false,
104105
StartBuiltinServer: false,
@@ -707,6 +708,7 @@ func NewContext() {
707708
}
708709
}
709710
SSH.AuthorizedKeysBackup = sec.Key("SSH_AUTHORIZED_KEYS_BACKUP").MustBool(true)
711+
SSH.ExposeAnonymous = sec.Key("SSH_EXPOSE_ANONYMOUS").MustBool(false)
710712

711713
if err = Cfg.Section("server").MapTo(&LFS); err != nil {
712714
log.Fatal(4, "Failed to map LFS settings: %v", err)

‎templates/repo/bare.tmpl

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,11 @@
2828
{{else}}
2929
<input id="repo-clone-url" value="{{$.CloneLink.SSH}}" readonly>
3030
{{end}}
31-
<button class="ui basic button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
32-
<i class="octicon octicon-clippy"></i>
33-
</button>
31+
{{if not (and $.DisableHTTP $.DisableSSH)}}
32+
<button class="ui basic button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
33+
<i class="octicon octicon-clippy"></i>
34+
</button>
35+
{{end}}
3436
</div>
3537
</div>
3638
<div class="ui divider"></div>

‎templates/repo/home.tmpl

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,19 +56,21 @@
5656
{{if UseHTTPS}}HTTPS{{else}}HTTP{{end}}
5757
</button>
5858
{{end}}
59-
{{if not $.DisableSSH}}
59+
{{if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
6060
<button class="ui basic clone button" id="repo-clone-ssh" data-link="{{.CloneLink.SSH}}">
6161
SSH
6262
</button>
6363
{{end}}
6464
{{if not $.DisableHTTP}}
6565
<input id="repo-clone-url" value="{{$.CloneLink.HTTPS}}" readonly>
66-
{{else}}
66+
{{else if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
6767
<input id="repo-clone-url" value="{{$.CloneLink.SSH}}" readonly>
6868
{{end}}
69-
<button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
70-
<i class="octicon octicon-clippy"></i>
71-
</button>
69+
{{if or ((not $.DisableHTTP) (and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)))}}
70+
<button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
71+
<i class="octicon octicon-clippy"></i>
72+
</button>
73+
{{end}}
7274
<div class="ui basic jump dropdown icon button poping up" data-content="{{.i18n.Tr "repo.download_archive"}}" data-variation="tiny inverted" data-position="top right">
7375
<i class="download icon"></i>
7476
<div class="menu">

‎templates/repo/wiki/view.tmpl

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,21 @@
3535
{{if UseHTTPS}}HTTPS{{else}}HTTP{{end}}
3636
</button>
3737
{{end}}
38-
{{if not $.DisableSSH}}
38+
{{if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
3939
<button class="ui basic clone button" id="repo-clone-ssh" data-link="{{.WikiCloneLink.SSH}}">
4040
SSH
4141
</button>
4242
{{end}}
4343
{{if not $.DisableHTTP}}
4444
<input id="repo-clone-url" value="{{$.WikiCloneLink.HTTPS}}" readonly>
45-
{{else}}
45+
{{else if and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)}}
4646
<input id="repo-clone-url" value="{{$.WikiCloneLink.SSH}}" readonly>
4747
{{end}}
48-
<button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
49-
<i class="octicon octicon-clippy"></i>
50-
</button>
48+
{{if or ((not $.DisableHTTP) (and (not $.DisableSSH) (or $.IsSigned $.ExposeAnonSSH)))}}
49+
<button class="ui basic icon button poping up clipboard" id="clipboard-btn" data-original="{{.i18n.Tr "repo.copy_link"}}" data-success="{{.i18n.Tr "repo.copy_link_success"}}" data-error="{{.i18n.Tr "repo.copy_link_error"}}" data-content="{{.i18n.Tr "repo.copy_link"}}" data-variation="inverted tiny" data-clipboard-target="#repo-clone-url">
50+
<i class="octicon octicon-clippy"></i>
51+
</button>
52+
{{end}}
5153
</div>
5254
</div>
5355
</div>

0 commit comments

Comments
 (0)