File inc/git.inc.php changed (mode: 100644) (index a1ddd11..66c6e80) |
... |
... |
function rg_git_clone($src, $dst) |
159 |
159 |
*/ |
*/ |
160 |
160 |
function rg_git_type($obj) |
function rg_git_type($obj) |
161 |
161 |
{ |
{ |
|
162 |
|
global $rg_git_zero; |
|
163 |
|
|
162 |
164 |
rg_prof_start("git_type"); |
rg_prof_start("git_type"); |
163 |
165 |
|
|
164 |
166 |
rg_log("git_type: obj=$obj"); |
rg_log("git_type: obj=$obj"); |
165 |
167 |
|
|
|
168 |
|
if (strcmp($obj, $rg_git_zero) == 0) |
|
169 |
|
return "zero"; |
|
170 |
|
|
166 |
171 |
$cmd = "git cat-file -t '" . $obj . "'"; |
$cmd = "git cat-file -t '" . $obj . "'"; |
167 |
172 |
$a = rg_exec($cmd); |
$a = rg_exec($cmd); |
168 |
173 |
if ($a['ok'] != 1) { |
if ($a['ok'] != 1) { |
|
... |
... |
function rg_git_rev_ok($rev) |
247 |
252 |
*/ |
*/ |
248 |
253 |
function rg_git_whitespace_ok($old, $new) |
function rg_git_whitespace_ok($old, $new) |
249 |
254 |
{ |
{ |
|
255 |
|
global $rg_git_zero; |
|
256 |
|
|
250 |
257 |
rg_prof_start("git_whitespace_ok"); |
rg_prof_start("git_whitespace_ok"); |
251 |
258 |
|
|
252 |
259 |
rg_log("git_whitespace_ok: old=$old new=$new"); |
rg_log("git_whitespace_ok: old=$old new=$new"); |
253 |
260 |
|
|
254 |
|
$cmd = "git diff --check " . $old . " " . $new; |
|
255 |
|
$a = rg_exec($cmd); |
|
256 |
|
if ($a['ok'] != 1) { |
|
257 |
|
rg_git_set_error("error on diff (" . $a['errmsg'] . ")"); |
|
258 |
|
$ret = FALSE; |
|
259 |
|
} else { |
|
|
261 |
|
// TODO: how should I check from 000000 till new?! |
|
262 |
|
if (strcmp($old, $rg_git_zero) == 0) { |
260 |
263 |
$ret = TRUE; |
$ret = TRUE; |
|
264 |
|
} else { |
|
265 |
|
$cmd = "git diff --check"; |
|
266 |
|
$cmd .= " " . escapeshellarg($old); |
|
267 |
|
$cmd .= " " . escapeshellarg($new); |
|
268 |
|
$a = rg_exec($cmd); |
|
269 |
|
rg_log("\ta:" . print_r($a, TRUE)); |
|
270 |
|
if ($a['ok'] != 1) { |
|
271 |
|
rg_git_set_error("error on diff (" . $a['errmsg'] . ")"); |
|
272 |
|
$ret = $a['data']; |
|
273 |
|
} else { |
|
274 |
|
$ret = TRUE; |
|
275 |
|
} |
261 |
276 |
} |
} |
262 |
277 |
|
|
263 |
278 |
rg_prof_end("git_whitespace_ok"); |
rg_prof_end("git_whitespace_ok"); |
|
... |
... |
function rg_git_update_ref($ref, $old, $new, $reason) |
295 |
310 |
{ |
{ |
296 |
311 |
rg_prof_start("git_update_ref"); |
rg_prof_start("git_update_ref"); |
297 |
312 |
|
|
298 |
|
rg_log("git_udpate_ref: ref=$ref old=$old new=$new reason=$reason"); |
|
|
313 |
|
rg_log("git_update_ref: ref=$ref old=$old new=$new reason=$reason"); |
|
314 |
|
|
|
315 |
|
$ret = FALSE; |
299 |
316 |
|
|
300 |
317 |
$cmd = "git update-ref"; |
$cmd = "git update-ref"; |
301 |
318 |
if (!empty($reason)) |
if (!empty($reason)) |
|
... |
... |
function rg_git_update_ref($ref, $old, $new, $reason) |
310 |
327 |
$cmd .= " " . escapeshellarg($old); |
$cmd .= " " . escapeshellarg($old); |
311 |
328 |
|
|
312 |
329 |
$a = rg_exec($cmd); |
$a = rg_exec($cmd); |
313 |
|
if ($a['ok'] != 1) { |
|
|
330 |
|
if ($a['ok'] == 1) { |
|
331 |
|
$ret = TRUE; |
|
332 |
|
} else { |
314 |
333 |
rg_git_set_error("error on update-ref (" . $a['errmsg'] . ")"); |
rg_git_set_error("error on update-ref (" . $a['errmsg'] . ")"); |
315 |
|
return FALSE; |
|
316 |
334 |
} |
} |
317 |
335 |
|
|
318 |
336 |
rg_prof_end("git_update_ref"); |
rg_prof_end("git_update_ref"); |
319 |
337 |
|
|
320 |
|
return TRUE; |
|
|
338 |
|
return $ret; |
321 |
339 |
} |
} |
322 |
340 |
|
|
323 |
341 |
/* |
/* |
|
... |
... |
function rg_git_update_tag($a) |
768 |
786 |
{ |
{ |
769 |
787 |
global $rg_git_zero; |
global $rg_git_zero; |
770 |
788 |
|
|
771 |
|
rg_log("git_update_tag"); |
|
|
789 |
|
rg_log("git_update_tag: " . rg_array2string($a)); |
772 |
790 |
|
|
773 |
|
if (strcmp($a['new_rev_type'], "commit") == 0) { // Un-annotated |
|
|
791 |
|
if (strcmp($a['new_rev_type'], "tag") == 0) { // Annotated |
|
792 |
|
if (strcmp($a['old_rev'], $rg_git_zero) == 0) { // create |
|
793 |
|
if (!rg_rights_allow($a['rights'], "S")) |
|
794 |
|
rg_git_fatal($a['refname'] . "\nNo rights to" |
|
795 |
|
. " create an annotated tag."); |
|
796 |
|
} else if (strcmp($a['new_rev'], $rg_git_zero) == 0) { // delete |
|
797 |
|
rg_log("delete ann tag"); |
|
798 |
|
if (!rg_rights_allow($a['rights'], "n")) |
|
799 |
|
rg_git_fatal($a['refname'] . "\nNo rights to" |
|
800 |
|
. " delete an annotated tag."); |
|
801 |
|
} else { // change |
|
802 |
|
if (!rg_rights_allow($a['rights'], "N")) |
|
803 |
|
rg_git_fatal($a['refname'] . "\nNo rights to" |
|
804 |
|
. " change an annotated tag."); |
|
805 |
|
} |
|
806 |
|
} else { // Un-annotated |
774 |
807 |
if (strcmp($a['old_rev'], $rg_git_zero) == 0) { // create |
if (strcmp($a['old_rev'], $rg_git_zero) == 0) { // create |
775 |
808 |
if (!rg_rights_allow($a['rights'], "Y")) |
if (!rg_rights_allow($a['rights'], "Y")) |
776 |
|
rg_git_fatal($a['refname'] . ":\nNo rights to" |
|
|
809 |
|
rg_git_fatal($a['refname'] . "\nNo rights to" |
777 |
810 |
. " create an un-annotated tag."); |
. " create an un-annotated tag."); |
778 |
811 |
} else if (strcmp($a['new_rev'], $rg_git_zero) == 0) { // delete |
} else if (strcmp($a['new_rev'], $rg_git_zero) == 0) { // delete |
779 |
|
if (!rg_rights_allow($a['rights'], "U")) |
|
780 |
|
rg_git_fatal($a['refname'] . ":\nNo rights to" |
|
|
812 |
|
if (!rg_rights_allow($a['rights'], "u")) |
|
813 |
|
rg_git_fatal($a['refname'] . "\nNo rights to" |
781 |
814 |
. " delete an un-annotated tag."); |
. " delete an un-annotated tag."); |
782 |
815 |
} else { // change |
} else { // change |
783 |
|
if (!rg_rights_allow($a['rights'], "u")) |
|
784 |
|
rg_git_fatal($a['refname'] . ":\nNo rights to" |
|
|
816 |
|
if (!rg_rights_allow($a['rights'], "U")) |
|
817 |
|
rg_git_fatal($a['refname'] . "\nNo rights to" |
785 |
818 |
. " change an un-annotated tag."); |
. " change an un-annotated tag."); |
786 |
819 |
} |
} |
787 |
|
} else if (strcmp($a['new_rev_type'], "tag") == 0) { // Annotated |
|
788 |
|
// TODO: Only change we can have here? |
|
789 |
|
if (!rg_rights_allow($a['rights'], "S")) |
|
790 |
|
rg_git_fatal($a['refname'] . ":\nNo rights to change an" |
|
791 |
|
. " annotated tag."); |
|
792 |
|
} else { |
|
793 |
|
rg_git_fatal("Strange tag!"); |
|
794 |
820 |
} |
} |
795 |
821 |
} |
} |
796 |
822 |
|
|
|
... |
... |
function rg_git_update_branch($a) |
798 |
824 |
{ |
{ |
799 |
825 |
global $rg_git_zero; |
global $rg_git_zero; |
800 |
826 |
|
|
801 |
|
rg_log("git_update_branch"); |
|
|
827 |
|
rg_log("git_update_branch: " . rg_array2string($a)); |
802 |
828 |
|
|
803 |
829 |
if (strcmp($a['new_rev'], $rg_git_zero) == 0) { // delete |
if (strcmp($a['new_rev'], $rg_git_zero) == 0) { // delete |
804 |
830 |
if (!rg_rights_allow($a['rights'], "D")) |
if (!rg_rights_allow($a['rights'], "D")) |
805 |
|
rg_git_fatal($a['refname'] . ":\nNo rights to delete" |
|
|
831 |
|
rg_git_fatal($a['refname'] . "\nNo rights to delete" |
806 |
832 |
. " a branch."); |
. " a branch."); |
807 |
833 |
return; |
return; |
808 |
834 |
} |
} |
|
... |
... |
function rg_git_update_branch($a) |
810 |
836 |
$check_fast_forward = 1; |
$check_fast_forward = 1; |
811 |
837 |
if (strcmp($a['old_rev'], $rg_git_zero) == 0) { // create |
if (strcmp($a['old_rev'], $rg_git_zero) == 0) { // create |
812 |
838 |
if (!rg_rights_allow($a['rights'], "C")) |
if (!rg_rights_allow($a['rights'], "C")) |
813 |
|
rg_git_fatal($a['refname'] . ":\nYou have no rights" |
|
|
839 |
|
rg_git_fatal($a['refname'] . "\nYou have no rights" |
814 |
840 |
. " to create a branch."); |
. " to create a branch."); |
815 |
841 |
$check_fast_forward = 0; |
$check_fast_forward = 0; |
816 |
842 |
} |
} |
|
... |
... |
function rg_git_update_branch($a) |
821 |
847 |
$merge_base = rg_git_merge_base($a['old_rev'], $a['new_rev']); |
$merge_base = rg_git_merge_base($a['old_rev'], $a['new_rev']); |
822 |
848 |
if ($merge_base === FALSE) { |
if ($merge_base === FALSE) { |
823 |
849 |
rg_log("Error in merge_base: " . rg_git_error()); |
rg_log("Error in merge_base: " . rg_git_error()); |
824 |
|
rg_git_fatal($a['refname'] . ":\nInternal error." |
|
|
850 |
|
rg_git_fatal($a['refname'] . "\nInternal error." |
825 |
851 |
. " Please try again later."); |
. " Please try again later."); |
826 |
852 |
} |
} |
827 |
853 |
|
|
828 |
|
if (strcmp($a['merge_base'], $a['old_rev']) != 0) |
|
829 |
|
rg_git_fatal($a['refname'] . ":\nNon fast-forward is" |
|
|
854 |
|
if (strcmp($merge_base, $a['old_rev']) != 0) |
|
855 |
|
rg_git_fatal($a['refname'] . "\nNon fast-forward is" |
830 |
856 |
. " not allowed."); |
. " not allowed."); |
831 |
857 |
} |
} |
832 |
858 |
|
|
|
859 |
|
// Check if user pushes a merge commit |
|
860 |
|
// TODO: Check all commits, not only the last one! |
|
861 |
|
if (!rg_rights_allow($a['rights'], "M")) { |
|
862 |
|
if (rg_git_rev_ok($a['new_rev'] . "^2")) |
|
863 |
|
rg_git_fatal($a['refname'] . "\nNo rights to push merges."); |
|
864 |
|
} |
|
865 |
|
|
|
866 |
|
// Check whitespace |
|
867 |
|
if (!rg_rights_allow($a['rights'], "W")) { |
|
868 |
|
$w = rg_git_whitespace_ok($a['old_rev'], $a['new_rev']); |
|
869 |
|
if ($w !== TRUE) |
|
870 |
|
rg_git_fatal($a['refname'] |
|
871 |
|
. "\nNo rights to push bad whitespace:" |
|
872 |
|
. "\n" . $w); |
|
873 |
|
} |
|
874 |
|
|
833 |
875 |
if (rg_rights_allow($a['rights'], "P") !== TRUE) { |
if (rg_rights_allow($a['rights'], "P") !== TRUE) { |
|
876 |
|
rg_log("\tPush is not allowed, let's see the anon one"); |
834 |
877 |
if (rg_rights_allow($a['rights'], "H") === FALSE) { |
if (rg_rights_allow($a['rights'], "H") === FALSE) { |
835 |
878 |
$msg = rg_template("msg/push_not_allowed.txt", array()); |
$msg = rg_template("msg/push_not_allowed.txt", array()); |
836 |
|
rg_git_fatal($a['refname']. ":\n" . $msg); |
|
|
879 |
|
rg_git_fatal($a['refname']. "\n" . $msg); |
837 |
880 |
} |
} |
838 |
881 |
|
|
839 |
882 |
// anonymous push - create a merge request |
// anonymous push - create a merge request |
|
883 |
|
// TODO: here, we may fail to update the reference; |
|
884 |
|
// the mr code should check if the update was done. |
840 |
885 |
$r = rg_mr_queue_add($a['repo_id'], $a['namespace'], |
$r = rg_mr_queue_add($a['repo_id'], $a['namespace'], |
841 |
886 |
$a['old_rev'], $a['new_rev'], $a['refname'], $a['ip']); |
$a['old_rev'], $a['new_rev'], $a['refname'], $a['ip']); |
842 |
887 |
if ($r !== TRUE) |
if ($r !== TRUE) |
843 |
888 |
rg_git_fatal($a['refname'] . ": " . rg_mr_error()); |
rg_git_fatal($a['refname'] . ": " . rg_mr_error()); |
844 |
|
$msg = rg_template("msg/push_merge_request.txt", array()); |
|
845 |
|
rg_git_info($a['refname'] . ":\n" . $msg); |
|
|
889 |
|
$msg = rg_template("msg/push_merge_request.txt", array()); |
|
890 |
|
rg_git_info($a['refname'] . "\n" . $msg); |
846 |
891 |
} else { |
} else { |
847 |
892 |
rg_log("We are allowed to push."); |
rg_log("We are allowed to push."); |
848 |
|
$r = rg_git_update_ref($a['refname'], $a['old_rev'], |
|
849 |
|
$a['new_rev'], "reason"); |
|
850 |
|
if ($r !== TRUE) { |
|
851 |
|
rg_log("update_ref: " . rg_git_error()); |
|
852 |
|
rg_git_fatal($a['refname'] . ":\nCannot update ref (" |
|
853 |
|
. rg_git_error() . ")"); |
|
854 |
|
} |
|
855 |
893 |
|
|
856 |
|
// We can clean now the namespace - TODO |
|
|
894 |
|
if (!empty($a['namespace'])) { |
|
895 |
|
// Update the main namespace |
|
896 |
|
$r = rg_git_update_ref($a['refname'], $a['old_rev'], |
|
897 |
|
$a['new_rev'], "reason"); |
|
898 |
|
if ($r !== TRUE) { |
|
899 |
|
rg_git_fatal($a['refname'] . "\nCannot update ref (" |
|
900 |
|
. rg_git_error() . ")"); |
|
901 |
|
} |
|
902 |
|
|
|
903 |
|
// We can clean now the namespace - TODO |
|
904 |
|
} |
857 |
905 |
} |
} |
858 |
906 |
} |
} |
859 |
907 |
|
|
File tests/hook_update.sh changed (mode: 100755) (index 8a5e05d..8038aba) |
... |
... |
if [ "${?}" != "1" ]; then |
24 |
24 |
exit 1 |
exit 1 |
25 |
25 |
fi |
fi |
26 |
26 |
echo "=== Testing push with rights..." |
echo "=== Testing push with rights..." |
27 |
|
export ROCKETGIT_REPO_RIGHTS="C" |
|
|
27 |
|
export ROCKETGIT_REPO_RIGHTS="CP" |
|
28 |
|
#strace -o cata.strace -ff -s200 \ |
28 |
29 |
git push origin master |
git push origin master |
29 |
30 |
if [ "${?}" != "0" ]; then |
if [ "${?}" != "0" ]; then |
30 |
31 |
echo "Should work!" |
echo "Should work!" |
|
... |
... |
if [ "${?}" != "1" ]; then |
41 |
42 |
exit 1 |
exit 1 |
42 |
43 |
fi |
fi |
43 |
44 |
echo "=== Testing not fast-forward with rights..." |
echo "=== Testing not fast-forward with rights..." |
44 |
|
export ROCKETGIT_REPO_RIGHTS="${ROCKETGIT_REPO_RIGHTS}OP" |
|
|
45 |
|
export ROCKETGIT_REPO_RIGHTS="COP" |
45 |
46 |
git push --force origin master |
git push --force origin master |
46 |
47 |
if [ "${?}" != "0" ]; then |
if [ "${?}" != "0" ]; then |
47 |
48 |
echo "Should work!" |
echo "Should work!" |
|
... |
... |
if [ "${?}" != "0" ]; then |
94 |
95 |
exit 1 |
exit 1 |
95 |
96 |
fi |
fi |
96 |
97 |
|
|
97 |
|
echo "=== Testing merge-commit without rights..." |
|
|
98 |
|
echo "=== Testing merge-commit without rights (${ROCKETGIT_REPO_RIGHTS})..." |
98 |
99 |
git checkout -b branch1 |
git checkout -b branch1 |
99 |
100 |
echo "ccc" >> a |
echo "ccc" >> a |
100 |
101 |
git commit -m "new b" a |
git commit -m "new b" a |
|
... |
... |
if [ "${?}" != "1" ]; then |
123 |
124 |
echo "Should not work!" |
echo "Should not work!" |
124 |
125 |
exit 1 |
exit 1 |
125 |
126 |
fi |
fi |
126 |
|
echo "=== Testing merge-commit with rights..." |
|
|
127 |
|
echo "=== Testing bad-whitespace with rights..." |
127 |
128 |
export ROCKETGIT_REPO_RIGHTS="${ROCKETGIT_REPO_RIGHTS}W" |
export ROCKETGIT_REPO_RIGHTS="${ROCKETGIT_REPO_RIGHTS}W" |
128 |
129 |
git push |
git push |
129 |
130 |
if [ "${?}" != "0" ]; then |
if [ "${?}" != "0" ]; then |
|
... |
... |
if [ "${?}" != "0" ]; then |
161 |
162 |
exit 1 |
exit 1 |
162 |
163 |
fi |
fi |
163 |
164 |
|
|
|
165 |
|
echo "=== Testing annotated tag change without rights..." |
|
166 |
|
echo "aaa" >> a; git commit -a -m "xx" |
|
167 |
|
git tag -d tag2 |
|
168 |
|
git tag -a tag2 -m "xxx2" |
|
169 |
|
git push origin --tags |
|
170 |
|
if [ "${?}" != "1" ]; then |
|
171 |
|
echo "Should not work!" |
|
172 |
|
exit 1 |
|
173 |
|
fi |
|
174 |
|
echo "=== Testing annotated tag change with rights..." |
|
175 |
|
export ROCKETGIT_REPO_RIGHTS="${ROCKETGIT_REPO_RIGHTS}N" |
|
176 |
|
git push origin --tags |
|
177 |
|
if [ "${?}" != "0" ]; then |
|
178 |
|
echo "Should work!" |
|
179 |
|
exit 1 |
|
180 |
|
fi |
|
181 |
|
|
|
182 |
|
echo "=== Testing annotated tag delete without rights (${ROCKETGIT_REPO_RIGHTS})..." |
|
183 |
|
git tag -d tag2 |
|
184 |
|
git push origin :refs/tags/tag2 |
|
185 |
|
if [ "${?}" != "1" ]; then |
|
186 |
|
echo "Should not work!" |
|
187 |
|
exit 1 |
|
188 |
|
fi |
|
189 |
|
echo "=== Testing annotated tag delete with rights..." |
|
190 |
|
export ROCKETGIT_REPO_RIGHTS="${ROCKETGIT_REPO_RIGHTS}n" |
|
191 |
|
git push origin :refs/tags/tag2 |
|
192 |
|
if [ "${?}" != "0" ]; then |
|
193 |
|
echo "Should work!" |
|
194 |
|
exit 1 |
|
195 |
|
fi |
|
196 |
|
|
164 |
197 |
|
|
165 |
198 |
cd .. |
cd .. |
166 |
199 |
echo "Rights=${ROCKETGIT_REPO_RIGHTS}." |
echo "Rights=${ROCKETGIT_REPO_RIGHTS}." |