Withhold the alternates file on the dumb transport

It lists object directories by their path on the server, which a
client fetching over http can neither use nor needs to learn. The
http-alternates file written for such clients still goes out.

1 file changed, 8 insertions, 0 deletions

diff --git a/source/ui-clone.c b/source/ui-clone.c
index 833c170..832a056 100644
--- a/source/ui-clone.c
+++ b/source/ui-clone.c
@@ -166,6 +166,14 @@ void cgit_clone_objects(void)
 		return;
 	}
 
+	// The alternates file names directories on the server's disk, which a
+	// client fetching over http cannot reach, so only the http form that
+	// is written for such clients goes out.
+	if (!strcmp(ctx.qry.path, "info/alternates")) {
+		cgit_print_error_page(404, "Not Found", "Not found");
+		return;
+	}
+
 	if (!path_is_safe(ctx.qry.path))
 		goto err;