Mirrors/gitea
0
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-05-11 02:54:05 +02:00
Code Issues Activity

lfs: locks and test fixes

Browse Source
This commit is contained in:
Adam Majer 2026-02-07 21:52:30 +01:00
parent 380d95b0d2
commit d8490031b2
2 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
services/lfs/server.go
View File

@ -463,12 +463,19 @@ func getAuthenticatedRepository(ctx *context.Context, rc *requestContext, requir
return nil
}
if !authenticate(ctx, repository, rc.Authorization, false, requireWrite) {
// Because of special ref "refs/for" (AGit), we need to delay/relax write permission check
// for LFS object uploads. LFS locks still require full write access.
lfsWriteMode := requireWrite
if lfsWriteMode && git.DefaultFeatures().SupportProcReceive {
lfsWriteMode = false
}
if !authenticate(ctx, repository, rc.Authorization, false, lfsWriteMode) {
requireAuth(ctx)
return nil
}
if requireWrite {
if lfsWriteMode {
context.CheckRepoScopedToken(ctx, repository, auth_model.Write)
} else {
context.CheckRepoScopedToken(ctx, repository, auth_model.Read)
@ -538,7 +545,7 @@ func writeStatusMessage(ctx *context.Context, status int, message string) {
// to proceed. This server assumes an HTTP Basic auth format.
func authenticate(ctx *context.Context, repository *repo_model.Repository, authorization string, requireSigned, requireWrite bool) bool {
accessMode := perm_model.AccessModeRead
if requireWrite && !git.DefaultFeatures().SupportProcReceive {
if requireWrite {
accessMode = perm_model.AccessModeWrite
}

13
tests/integration/git_general_test.go
View File

@ -166,13 +166,18 @@ func doSSHLFSAccessTest(_ APITestContext, keyID int64) func(*testing.T) {
t.Run("User2AccessOther", func(t *testing.T) {
sshCmdUser2Other := append(slices.Clone(sshCmdParts),
"-p", strconv.Itoa(setting.SSH.ListenPort), "git@"+setting.SSH.ListenHost,
"git-lfs-authenticate", "user5/repo4.git", "upload", // inaccessible to other's (user5/repo4)
"git-lfs-authenticate", "user5/repo4.git", "upload", // accessible to other's (user5/repo4) if AGit is supported
)
cmd := exec.CommandContext(t.Context(), sshCmdUser2Other[0], sshCmdUser2Other[1:]...)
_, err := cmd.Output()
var errExit *exec.ExitError
require.ErrorAs(t, err, &errExit) // inaccessible, error
assert.Contains(t, string(errExit.Stderr), fmt.Sprintf("User: 2:user2 with Key: %d:test-key is not authorized to write to user5/repo4.", keyID))
if git.DefaultFeatures().SupportProcReceive {
assert.NoError(t, err) // relaxed for AGit
} else {
var errExit *exec.ExitError
require.ErrorAs(t, err, &errExit) // inaccessible, error
assert.Contains(t, string(errExit.Stderr), fmt.Sprintf("User: 2:user2 with Key: %d:test-key is not authorized to write to user5/repo4.", keyID))
}
})
}
}