Re: [PATCH] transport: do not allow to push over git:// protocol

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



2011/10/3 Jeff King <peff@xxxxxxxx>:
> So yeah, that makes it even worse for the client to start refusing this
> without even contacting the server. I forgot that we added the "ERR"
> response way back in a807328 (connect.c: add a way for git-daemon to
> pass an error back to client, 2008-11-01).
>
> GitHub uses it to make nice messages:
>
>  $ git push origin
>  fatal: remote error:
>    You can't push to git://github.com/gitster/git.git
>    Use git@xxxxxxxxxx:gitster/git.git
>
> We should maybe do something like the patch below:

Jonathan also mentions another patch

http://article.gmane.org/gmane.comp.version-control.git/182536

> but:
>
>  1. There is some information leakage there. In particular, one can
>     tell the difference now between "repo does not exist" and
>     "receive-pack is not turned on". Personally, I think the tradeoff
>     to have actual error messages is worth it. HTTP has had real error
>     codes for decades, and I don't think anybody is too up-in-arms that
>     I can probe which pages are 404, and which are 401.

To me, just "<service>: access denied" is enough. Not particularly
friendly but should be a good enough clue.
-- 
Duy
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]