2019-06-01 23:00:21 +08:00
// Copyright 2019 The Gitea Authors. All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
// Package private includes all internal routes. The package name internal is ideal but Golang is not allowed, so we use private as package name instead.
package private
import (
"fmt"
"net/http"
"strings"
"code.gitea.io/gitea/models"
2021-11-28 19:58:28 +08:00
"code.gitea.io/gitea/models/perm"
2021-12-10 09:27:50 +08:00
repo_model "code.gitea.io/gitea/models/repo"
2021-11-10 03:57:58 +08:00
"code.gitea.io/gitea/models/unit"
2021-11-24 17:49:20 +08:00
user_model "code.gitea.io/gitea/models/user"
2021-01-26 23:36:53 +08:00
"code.gitea.io/gitea/modules/context"
2021-07-28 17:42:56 +08:00
"code.gitea.io/gitea/modules/git"
2019-06-01 23:00:21 +08:00
"code.gitea.io/gitea/modules/log"
"code.gitea.io/gitea/modules/private"
"code.gitea.io/gitea/modules/setting"
2019-12-15 10:49:52 +08:00
repo_service "code.gitea.io/gitea/services/repository"
2020-01-08 02:27:36 +08:00
wiki_service "code.gitea.io/gitea/services/wiki"
2019-06-01 23:00:21 +08:00
)
// ServNoCommand returns information about the provided keyid
2021-01-26 23:36:53 +08:00
func ServNoCommand ( ctx * context . PrivateContext ) {
2019-06-01 23:00:21 +08:00
keyID := ctx . ParamsInt64 ( ":keyid" )
if keyID <= 0 {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusBadRequest , private . Response {
Err : fmt . Sprintf ( "Bad key id: %d" , keyID ) ,
2019-06-01 23:00:21 +08:00
} )
}
results := private . KeyAndOwner { }
key , err := models . GetPublicKeyByID ( keyID )
if err != nil {
if models . IsErrKeyNotExist ( err ) {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusUnauthorized , private . Response {
Err : fmt . Sprintf ( "Cannot find key: %d" , keyID ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
log . Error ( "Unable to get public key: %d Error: %v" , keyID , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . Response {
Err : err . Error ( ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
results . Key = key
2020-10-11 08:38:09 +08:00
if key . Type == models . KeyTypeUser || key . Type == models . KeyTypePrincipal {
2021-11-24 17:49:20 +08:00
user , err := user_model . GetUserByID ( key . OwnerID )
2019-06-01 23:00:21 +08:00
if err != nil {
2021-11-24 17:49:20 +08:00
if user_model . IsErrUserNotExist ( err ) {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusUnauthorized , private . Response {
Err : fmt . Sprintf ( "Cannot find owner with id: %d for key: %d" , key . OwnerID , keyID ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
log . Error ( "Unable to get owner with id: %d for public key: %d Error: %v" , key . OwnerID , keyID , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . Response {
Err : err . Error ( ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
2020-11-13 07:29:11 +08:00
if ! user . IsActive || user . ProhibitLogin {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusForbidden , private . Response {
Err : "Your account is disabled." ,
2020-11-13 07:29:11 +08:00
} )
return
}
2019-06-01 23:00:21 +08:00
results . Owner = user
}
ctx . JSON ( http . StatusOK , & results )
}
// ServCommand returns information about the provided keyid
2021-01-26 23:36:53 +08:00
func ServCommand ( ctx * context . PrivateContext ) {
2019-06-01 23:00:21 +08:00
keyID := ctx . ParamsInt64 ( ":keyid" )
ownerName := ctx . Params ( ":owner" )
repoName := ctx . Params ( ":repo" )
2021-11-28 19:58:28 +08:00
mode := perm . AccessMode ( ctx . FormInt ( "mode" ) )
2019-06-01 23:00:21 +08:00
// Set the basic parts of the results to return
results := private . ServCommandResults {
RepoName : repoName ,
OwnerName : ownerName ,
KeyID : keyID ,
}
2020-08-20 22:53:06 +08:00
// Now because we're not translating things properly let's just default some English strings here
2019-06-01 23:00:21 +08:00
modeString := "read"
2021-11-28 19:58:28 +08:00
if mode > perm . AccessModeRead {
2019-06-01 23:00:21 +08:00
modeString = "write to"
}
// The default unit we're trying to look at is code
2021-11-10 03:57:58 +08:00
unitType := unit . TypeCode
2019-06-01 23:00:21 +08:00
// Unless we're a wiki...
if strings . HasSuffix ( repoName , ".wiki" ) {
// in which case we need to look at the wiki
2021-11-10 03:57:58 +08:00
unitType = unit . TypeWiki
2019-06-01 23:00:21 +08:00
// And we'd better munge the reponame and tell downstream we're looking at a wiki
results . IsWiki = true
results . RepoName = repoName [ : len ( repoName ) - 5 ]
}
2021-11-24 17:49:20 +08:00
owner , err := user_model . GetUserByName ( results . OwnerName )
2020-11-13 07:29:11 +08:00
if err != nil {
log . Error ( "Unable to get repository owner: %s/%s Error: %v" , results . OwnerName , results . RepoName , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Unable to get repository owner: %s/%s %v" , results . OwnerName , results . RepoName , err ) ,
2020-11-13 07:29:11 +08:00
} )
return
}
2020-11-18 17:58:25 +08:00
if ! owner . IsOrganization ( ) && ! owner . IsActive {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusForbidden , private . ErrServCommand {
Results : results ,
Err : "Repository cannot be accessed, you could retry it later" ,
2020-11-13 07:29:11 +08:00
} )
return
}
2019-06-01 23:00:21 +08:00
// Now get the Repository and set the results section
2019-12-15 10:49:52 +08:00
repoExist := true
2021-12-10 09:27:50 +08:00
repo , err := repo_model . GetRepositoryByName ( owner . ID , results . RepoName )
2019-06-01 23:00:21 +08:00
if err != nil {
2021-12-10 09:27:50 +08:00
if repo_model . IsErrRepoNotExist ( err ) {
2019-12-15 10:49:52 +08:00
repoExist = false
2021-07-29 09:42:15 +08:00
for _ , verb := range ctx . FormStrings ( "verb" ) {
2020-02-05 17:40:35 +08:00
if "git-upload-pack" == verb {
// User is fetching/cloning a non-existent repository
2020-12-09 01:54:33 +08:00
log . Error ( "Failed authentication attempt (cannot find repository: %s/%s) from %s" , results . OwnerName , results . RepoName , ctx . RemoteAddr ( ) )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusNotFound , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Cannot find repository: %s/%s" , results . OwnerName , results . RepoName ) ,
2020-02-05 17:40:35 +08:00
} )
return
}
}
2019-12-15 10:49:52 +08:00
} else {
log . Error ( "Unable to get repository: %s/%s Error: %v" , results . OwnerName , results . RepoName , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Unable to get repository: %s/%s %v" , results . OwnerName , results . RepoName , err ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
}
2019-12-15 10:49:52 +08:00
if repoExist {
2020-11-13 07:29:11 +08:00
repo . Owner = owner
2019-12-15 10:49:52 +08:00
repo . OwnerName = ownerName
results . RepoID = repo . ID
2019-10-13 21:23:14 +08:00
2019-12-15 10:49:52 +08:00
if repo . IsBeingCreated ( ) {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : "Repository is being created, you could retry after it finished" ,
2019-12-15 10:49:52 +08:00
} )
return
}
2021-11-23 06:32:16 +08:00
if repo . IsBroken ( ) {
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : "Repository is in a broken state" ,
} )
return
}
2019-12-15 10:49:52 +08:00
// We can shortcut at this point if the repo is a mirror
2021-11-28 19:58:28 +08:00
if mode > perm . AccessModeRead && repo . IsMirror {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusForbidden , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Mirror Repository %s/%s is read-only" , results . OwnerName , results . RepoName ) ,
2019-12-15 10:49:52 +08:00
} )
return
}
2019-06-01 23:00:21 +08:00
}
// Get the Public Key represented by the keyID
key , err := models . GetPublicKeyByID ( keyID )
if err != nil {
if models . IsErrKeyNotExist ( err ) {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusNotFound , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Cannot find key: %d" , keyID ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
log . Error ( "Unable to get public key: %d Error: %v" , keyID , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Unable to get key: %d Error: %v" , keyID , err ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
results . KeyName = key . Name
results . KeyID = key . ID
results . UserID = key . OwnerID
2019-12-15 10:49:52 +08:00
// If repo doesn't exist, deploy key doesn't make sense
if ! repoExist && key . Type == models . KeyTypeDeploy {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusNotFound , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Cannot find repository %s/%s" , results . OwnerName , results . RepoName ) ,
2019-12-15 10:49:52 +08:00
} )
return
}
2019-06-01 23:00:21 +08:00
// Deploy Keys have ownerID set to 0 therefore we can't use the owner
// So now we need to check if the key is a deploy key
// We'll keep hold of the deploy key here for permissions checking
var deployKey * models . DeployKey
2021-11-24 17:49:20 +08:00
var user * user_model . User
2019-06-01 23:00:21 +08:00
if key . Type == models . KeyTypeDeploy {
results . IsDeployKey = true
var err error
deployKey , err = models . GetDeployKeyByRepo ( key . ID , repo . ID )
if err != nil {
if models . IsErrDeployKeyNotExist ( err ) {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusNotFound , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Public (Deploy) Key: %d:%s is not authorized to %s %s/%s." , key . ID , key . Name , modeString , results . OwnerName , results . RepoName ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
log . Error ( "Unable to get deploy for public (deploy) key: %d in %-v Error: %v" , key . ID , repo , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Unable to get Deploy Key for Public Key: %d:%s in %s/%s." , key . ID , key . Name , results . OwnerName , results . RepoName ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
results . KeyName = deployKey . Name
// FIXME: Deploy keys aren't really the owner of the repo pushing changes
// however we don't have good way of representing deploy keys in hook.go
// so for now use the owner of the repository
results . UserName = results . OwnerName
results . UserID = repo . OwnerID
2020-08-30 15:24:39 +08:00
if ! repo . Owner . KeepEmailPrivate {
results . UserEmail = repo . Owner . Email
}
2019-06-01 23:00:21 +08:00
} else {
// Get the user represented by the Key
var err error
2021-11-24 17:49:20 +08:00
user , err = user_model . GetUserByID ( key . OwnerID )
2019-06-01 23:00:21 +08:00
if err != nil {
2021-11-24 17:49:20 +08:00
if user_model . IsErrUserNotExist ( err ) {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusUnauthorized , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Public Key: %d:%s owner %d does not exist." , key . ID , key . Name , key . OwnerID ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
log . Error ( "Unable to get owner: %d for public key: %d:%s Error: %v" , key . OwnerID , key . ID , key . Name , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Unable to get Owner: %d for Deploy Key: %d:%s in %s/%s." , key . OwnerID , key . ID , key . Name , ownerName , repoName ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
2020-11-13 07:29:11 +08:00
if ! user . IsActive || user . ProhibitLogin {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusForbidden , private . Response {
Err : "Your account is disabled." ,
2020-11-13 07:29:11 +08:00
} )
return
}
2019-06-01 23:00:21 +08:00
results . UserName = user . Name
2020-08-30 15:24:39 +08:00
if ! user . KeepEmailPrivate {
results . UserEmail = user . Email
}
2019-06-01 23:00:21 +08:00
}
// Don't allow pushing if the repo is archived
2021-11-28 19:58:28 +08:00
if repoExist && mode > perm . AccessModeRead && repo . IsArchived {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusUnauthorized , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Repo: %s/%s is archived." , results . OwnerName , results . RepoName ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
// Permissions checking:
2021-10-21 04:59:05 +08:00
if repoExist &&
2021-11-28 19:58:28 +08:00
( mode > perm . AccessModeRead ||
2021-10-21 04:59:05 +08:00
repo . IsPrivate ||
owner . Visibility . IsPrivate ( ) ||
2021-10-26 07:24:19 +08:00
( user != nil && user . IsRestricted ) || // user will be nil if the key is a deploykey
2021-10-21 04:59:05 +08:00
setting . Service . RequireSignInView ) {
2019-06-01 23:00:21 +08:00
if key . Type == models . KeyTypeDeploy {
if deployKey . Mode < mode {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusUnauthorized , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Deploy Key: %d:%s is not authorized to %s %s/%s." , key . ID , key . Name , modeString , results . OwnerName , results . RepoName ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
} else {
2021-10-21 04:59:05 +08:00
// Because of the special ref "refs/for" we will need to delay write permission check
2021-11-10 03:57:58 +08:00
if git . SupportProcReceive && unitType == unit . TypeCode {
2021-11-28 19:58:28 +08:00
mode = perm . AccessModeRead
2021-07-28 17:42:56 +08:00
}
2019-06-01 23:00:21 +08:00
perm , err := models . GetUserRepoPermission ( repo , user )
if err != nil {
log . Error ( "Unable to get permissions for %-v with key %d in %-v Error: %v" , user , key . ID , repo , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Unable to get permissions for user %d:%s with key %d in %s/%s Error: %v" , user . ID , user . Name , key . ID , results . OwnerName , results . RepoName , err ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
userMode := perm . UnitAccessMode ( unitType )
if userMode < mode {
2020-12-09 01:54:33 +08:00
log . Error ( "Failed authentication attempt for %s with key %s (not authorized to %s %s/%s) from %s" , user . Name , key . Name , modeString , ownerName , repoName , ctx . RemoteAddr ( ) )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusUnauthorized , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "User: %d:%s with Key: %d:%s is not authorized to %s %s/%s." , user . ID , user . Name , key . ID , key . Name , modeString , ownerName , repoName ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
}
}
2019-12-15 10:49:52 +08:00
// We already know we aren't using a deploy key
if ! repoExist {
2021-11-24 17:49:20 +08:00
owner , err := user_model . GetUserByName ( ownerName )
2019-12-15 10:49:52 +08:00
if err != nil {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Unable to get owner: %s %v" , results . OwnerName , err ) ,
2019-12-15 10:49:52 +08:00
} )
return
}
if owner . IsOrganization ( ) && ! setting . Repository . EnablePushCreateOrg {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusForbidden , private . ErrServCommand {
Results : results ,
Err : "Push to create is not enabled for organizations." ,
2019-12-15 10:49:52 +08:00
} )
return
}
if ! owner . IsOrganization ( ) && ! setting . Repository . EnablePushCreateUser {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusForbidden , private . ErrServCommand {
Results : results ,
Err : "Push to create is not enabled for users." ,
2019-12-15 10:49:52 +08:00
} )
return
}
repo , err = repo_service . PushCreateRepo ( user , owner , results . RepoName )
if err != nil {
log . Error ( "pushCreateRepo: %v" , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusNotFound , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Cannot find repository: %s/%s" , results . OwnerName , results . RepoName ) ,
2019-12-15 10:49:52 +08:00
} )
return
}
results . RepoID = repo . ID
}
2019-06-01 23:00:21 +08:00
if results . IsWiki {
2020-04-19 22:26:58 +08:00
// Ensure the wiki is enabled before we allow access to it
2021-11-10 03:57:58 +08:00
if _ , err := repo . GetUnit ( unit . TypeWiki ) ; err != nil {
2021-12-10 09:27:50 +08:00
if repo_model . IsErrUnitTypeNotExist ( err ) {
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusForbidden , private . ErrServCommand {
Results : results ,
Err : "repository wiki is disabled" ,
2020-04-19 22:26:58 +08:00
} )
return
}
log . Error ( "Failed to get the wiki unit in %-v Error: %v" , repo , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Failed to get the wiki unit in %s/%s Error: %v" , ownerName , repoName , err ) ,
2020-04-19 22:26:58 +08:00
} )
return
}
// Finally if we're trying to touch the wiki we should init it
2020-01-08 02:27:36 +08:00
if err = wiki_service . InitWiki ( repo ) ; err != nil {
2019-06-01 23:00:21 +08:00
log . Error ( "Failed to initialize the wiki in %-v Error: %v" , repo , err )
2021-06-24 03:38:19 +08:00
ctx . JSON ( http . StatusInternalServerError , private . ErrServCommand {
Results : results ,
Err : fmt . Sprintf ( "Failed to initialize the wiki in %s/%s Error: %v" , ownerName , repoName , err ) ,
2019-06-01 23:00:21 +08:00
} )
return
}
}
log . Debug ( "Serv Results:\nIsWiki: %t\nIsDeployKey: %t\nKeyID: %d\tKeyName: %s\nUserName: %s\nUserID: %d\nOwnerName: %s\nRepoName: %s\nRepoID: %d" ,
results . IsWiki ,
results . IsDeployKey ,
results . KeyID ,
results . KeyName ,
results . UserName ,
results . UserID ,
results . OwnerName ,
results . RepoName ,
results . RepoID )
ctx . JSON ( http . StatusOK , results )
// We will update the keys in a different call.
}