Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check the modes the hooks write under
No hook ran under a restrictive umask, so dropping the forced umask 022
passed, and the age file and the graph would then be unreadable to the
web server. Git alone writes the graph as -r-------- under umask 077.
core.sharedRepository was only tried as group, so the case folding and
the numeric modes went unchecked.
Diffstat (limited to 'tests')
| -rwxr-xr-x | tests/t0507-hooks.sh | 38 |
1 file changed, 38 insertions, 0 deletions
diff --git a/tests/t0507-hooks.sh b/tests/t0507-hooks.sh index 9f55547..4d5a9e3 100755 --- a/tests/t0507-hooks.sh +++ b/tests/t0507-hooks.sh @@ -203,6 +203,33 @@ do test_grep "^drwxrw[xs]" mode ' + # The web server reads what the hooks write, so the pusher's own umask + # must not keep it out. + test_expect_success "the age hook writes a file anyone can read under a tight umask under $shell" ' + git init -q --bare private-$shell.git && + git -C work push -q ../private-$shell.git main && + (cd private-$shell.git && umask 077 && $shell "$HOOK_DIRECTORY/post-receive.cgit-age" 2>../err) && + test_must_be_empty err && + ls -ld private-$shell.git/info/web private-$shell.git/info/web/last-modified >mode && + test_grep "^drwxr-xr-x" mode && + test_grep "^-rw-r--r--" mode + ' + + test_expect_success "the age hook reads core.sharedRepository as git does under $shell" ' + git -C private-$shell.git config core.sharedRepository FALSE && + rm private-$shell.git/info/web/last-modified && + (cd private-$shell.git && umask 077 && $shell "$HOOK_DIRECTORY/post-receive.cgit-age" 2>../err) && + test_must_be_empty err && + ls -l private-$shell.git/info/web/last-modified >mode && + test_grep "^-rw-r--r--" mode && + git -C private-$shell.git config core.sharedRepository 0660 && + rm private-$shell.git/info/web/last-modified && + (cd private-$shell.git && umask 077 && $shell "$HOOK_DIRECTORY/post-receive.cgit-age" 2>../err) && + test_must_be_empty err && + ls -l private-$shell.git/info/web/last-modified >mode && + test_grep "^-rw-rw-r--" mode + ' + test_expect_success "the commit-graph hook writes a graph with path filters under $shell" ' git init -q --bare graph-$shell.git && git -C work push -q ../graph-$shell.git main && @@ -213,6 +240,17 @@ do git -C graph-$shell.git commit-graph verify ' + test_expect_success "the commit-graph hook writes a graph anyone can read under a tight umask under $shell" ' + git init -q --bare private-graph-$shell.git && + git -C work push -q ../private-graph-$shell.git main && + (cd private-graph-$shell.git && umask 077 && $shell "$HOOK_DIRECTORY/post-receive.commit-graph" 2>../err) && + test_must_be_empty err && + ls -l private-graph-$shell.git/objects/info/commit-graphs >modes && + test_grep "commit-graph-chain" modes && + test_grep "\.graph" modes && + test_grep ! "^-r-------" modes + ' + test_expect_success "a later push moves the graph on under $shell" ' cat graph-$shell.git/objects/info/commit-graphs/commit-graph-chain >chain-$shell && test_commit -C work graph-$shell && |