hgweb: support for deny_read/allow_read options

reimplementation of a patch provided by Nilton Volpato.

Folded into a single patch by Thomas Arendsen Hein.

doc/hgrc.5.txt

@@ -1,751 +1,773 b''
 HGRC(5)
 =======
 Bryan O'Sullivan <[e-mail]>
 
 NAME
 ----
 hgrc - configuration files for Mercurial
 
 SYNOPSIS
 --------
 
 The Mercurial system uses a set of configuration files to control
 aspects of its behaviour.
 
 FILES
 -----
 
 Mercurial reads configuration data from several files, if they exist.
 The names of these files depend on the system on which Mercurial is
 installed. *.rc files from a single directory are read in
 alphabetical order, later ones overriding earlier ones. Where
 multiple paths are given below, settings from later paths override
 earlier ones.
 
 (Unix) <install-root>/etc/mercurial/hgrc.d/*.rc::
 (Unix) <install-root>/etc/mercurial/hgrc::
     Per-installation configuration files, searched for in the
     directory where Mercurial is installed. <install-root> is the
     parent directory of the hg executable (or symlink) being run.
     For example, if installed in /shared/tools/bin/hg, Mercurial will
     look in /shared/tools/etc/mercurial/hgrc. Options in these files
     apply to all Mercurial commands executed by any user in any
     directory.
 
 (Unix) /etc/mercurial/hgrc.d/*.rc::
 (Unix) /etc/mercurial/hgrc::
     Per-system configuration files, for the system on which Mercurial
     is running. Options in these files apply to all Mercurial
     commands executed by any user in any directory. Options in these
     files override per-installation options.
 
 (Windows) <install-dir>\Mercurial.ini::
   or else::
 (Windows) HKEY_LOCAL_MACHINE\SOFTWARE\Mercurial::
   or else::
 (Windows) C:\Mercurial\Mercurial.ini::
     Per-installation/system configuration files, for the system on
     which Mercurial is running. Options in these files apply to all
     Mercurial commands executed by any user in any directory.
     Registry keys contain PATH-like strings, every part of which must
     reference a Mercurial.ini file or be a directory where *.rc files
     will be read.
 
 (Unix) $HOME/.hgrc::
 (Windows) %HOME%\Mercurial.ini::
 (Windows) %HOME%\.hgrc::
 (Windows) %USERPROFILE%\Mercurial.ini::
 (Windows) %USERPROFILE%\.hgrc::
     Per-user configuration file(s), for the user running Mercurial.
     On Windows 9x, %HOME% is replaced by %APPDATA%.
     Options in these files apply to all Mercurial commands executed
     by this user in any directory. Options in thes files override
     per-installation and per-system options.
 
 (Unix, Windows) <repo>/.hg/hgrc::
     Per-repository configuration options that only apply in a
     particular repository. This file is not version-controlled, and
     will not get transferred during a "clone" operation. Options in
     this file override options in all other configuration files.
     On Unix, most of this file will be ignored if it doesn't belong
     to a trusted user or to a trusted group. See the documentation
     for the trusted section below for more details.
 
 SYNTAX
 ------
 
 A configuration file consists of sections, led by a "[section]" header
 and followed by "name: value" entries; "name=value" is also accepted.
 
     [spam]
     eggs=ham
     green=
        eggs
 
 Each line contains one entry. If the lines that follow are indented,
 they are treated as continuations of that entry.
 
 Leading whitespace is removed from values. Empty lines are skipped.
 
 The optional values can contain format strings which refer to other
 values in the same section, or values in a special DEFAULT section.
 
 Lines beginning with "#" or ";" are ignored and may be used to provide
 comments.
 
 SECTIONS
 --------
 
 This section describes the different sections that may appear in a
 Mercurial "hgrc" file, the purpose of each section, its possible
 keys, and their possible values.
 
 [[decode]]
 decode/encode::
   Filters for transforming files on checkout/checkin. This would
   typically be used for newline processing or other
   localization/canonicalization of files.
 
   Filters consist of a filter pattern followed by a filter command.
   Filter patterns are globs by default, rooted at the repository
   root. For example, to match any file ending in ".txt" in the root
   directory only, use the pattern "*.txt". To match any file ending
   in ".c" anywhere in the repository, use the pattern "**.c".
 
   The filter command can start with a specifier, either "pipe:" or
   "tempfile:". If no specifier is given, "pipe:" is used by default.
 
   A "pipe:" command must accept data on stdin and return the
   transformed data on stdout.
 
   Pipe example:
 
     [encode]
     # uncompress gzip files on checkin to improve delta compression
     # note: not necessarily a good idea, just an example
     *.gz = pipe: gunzip
 
     [decode]
     # recompress gzip files when writing them to the working dir (we
     # can safely omit "pipe:", because it's the default)
     *.gz = gzip
 
   A "tempfile:" command is a template. The string INFILE is replaced
   with the name of a temporary file that contains the data to be
   filtered by the command. The string OUTFILE is replaced with the
   name of an empty temporary file, where the filtered data must be
   written by the command.
 
   NOTE: the tempfile mechanism is recommended for Windows systems,
   where the standard shell I/O redirection operators often have
   strange effects and may corrupt the contents of your files.
 
   The most common usage is for LF <-> CRLF translation on Windows.
   For this, use the "smart" convertors which check for binary files:
 
     [extensions]
     hgext.win32text =
     [encode]
     ** = cleverencode:
     [decode]
     ** = cleverdecode:
 
   or if you only want to translate certain files:
 
     [extensions]
     hgext.win32text =
     [encode]
     **.txt = dumbencode:
     [decode]
     **.txt = dumbdecode:
 
 [[defaults]]
 defaults::
   Use the [defaults] section to define command defaults, i.e. the
   default options/arguments to pass to the specified commands.
 
   The following example makes 'hg log' run in verbose mode, and
   'hg status' show only the modified files, by default.
 
     [defaults]
     log = -v
     status = -m
 
   The actual commands, instead of their aliases, must be used when
   defining command defaults. The command defaults will also be
   applied to the aliases of the commands defined.
 
 [[diff]]
 diff::
   Settings used when displaying diffs. They are all boolean and
   defaults to False.
   git;;
     Use git extended diff format.
   nodates;;
     Don't include dates in diff headers.
   showfunc;;
     Show which function each change is in.
   ignorews;;
     Ignore white space when comparing lines.
   ignorewsamount;;
     Ignore changes in the amount of white space.
   ignoreblanklines;;
     Ignore changes whose lines are all blank.
 
 [[email]]
 email::
   Settings for extensions that send email messages.
   from;;
     Optional. Email address to use in "From" header and SMTP envelope
     of outgoing messages.
   to;;
     Optional. Comma-separated list of recipients' email addresses.
   cc;;
     Optional. Comma-separated list of carbon copy recipients'
     email addresses.
   bcc;;
     Optional. Comma-separated list of blind carbon copy
     recipients' email addresses. Cannot be set interactively.
   method;;
     Optional. Method to use to send email messages. If value is
     "smtp" (default), use SMTP (see section "[smtp]" for
     configuration). Otherwise, use as name of program to run that
     acts like sendmail (takes "-f" option for sender, list of
     recipients on command line, message on stdin). Normally, setting
     this to "sendmail" or "/usr/sbin/sendmail" is enough to use
     sendmail to send messages.
   charsets;;
     Optional. Comma-separated list of charsets considered
     convenient for recipients. Addresses, headers, and parts not
     containing patches of outgoing messages will be encoded in
     the first charset to which conversion from local encoding
     (ui.encoding, ui.fallbackencoding) succeeds. If correct
     conversion fails, the text in question is sent as is.
     Defaults to empty (explicit) list.
 
   Order of outgoing email charsets:
  
     us-ascii             always first, regardless of settings
     email.charsets       in order given by user
     ui.fallbackencoding  if not in email.charsets
     ui.encoding          if not in email.charsets
     utf-8                always last, regardless of settings
 
   Email example:
 
     [email]
     from = Joseph User <[e-mail]>
     method = /usr/sbin/sendmail
     # charsets for western europeans
     # us-ascii, utf-8 omitted, as they are tried first and last
     charsets = iso-8859-1, iso-8859-15, windows-1252
 
 [[extensions]]
 extensions::
   Mercurial has an extension mechanism for adding new features. To
   enable an extension, create an entry for it in this section.
 
   If you know that the extension is already in Python's search path,
   you can give the name of the module, followed by "=", with nothing
   after the "=".
 
   Otherwise, give a name that you choose, followed by "=", followed by
   the path to the ".py" file (including the file name extension) that
   defines the extension.
 
   To explicitly disable an extension that is enabled in an hgrc of
   broader scope, prepend its path with '!', as in
   'hgext.foo = !/ext/path' or 'hgext.foo = !' when no path is supplied.
 
   Example for ~/.hgrc:
 
     [extensions]
     # (the mq extension will get loaded from mercurial's path)
     hgext.mq =
     # (this extension will get loaded from the file specified)
     myfeature = ~/.hgext/myfeature.py
 
 [[format]]
 format::
 
   usestore;;
     Enable or disable the "store" repository format which improves
     compatibility with systems that fold case or otherwise mangle
     filenames. Enabled by default. Disabling this option will allow
     you to store longer filenames in some situations at the expense of
     compatibility and ensures that the on-disk format of newly created
     repositories will be compatible with Mercurial before version 0.9.4.
 
   usefncache;;
     Enable or disable the "fncache" repository format which enhances
     the "store" repository format (which has to be enabled to use
     fncache) to allow longer filenames and avoids using Windows reserved
     names, e.g. "nul". Enabled by default. Disabling this option ensures
     that the on-disk format of newly created repositories will be
     compatible with Mercurial before version 1.1.
 
 [[merge-patterns]]
 merge-patterns::
   This section specifies merge tools to associate with particular file
   patterns. Tools matched here will take precedence over the default
   merge tool. Patterns are globs by default, rooted at the repository root.
 
   Example:
 
     [merge-patterns]
     **.c = kdiff3
     **.jpg = myimgmerge
 
 [[merge-tools]]
 merge-tools::
   This section configures external merge tools to use for file-level
   merges.
 
   Example ~/.hgrc:
 
     [merge-tools]
     # Override stock tool location
     kdiff3.executable = ~/bin/kdiff3
     # Specify command line
     kdiff3.args = $base $local $other -o $output
     # Give higher priority
     kdiff3.priority = 1
 
     # Define new tool
     myHtmlTool.args = -m $local $other $base $output
     myHtmlTool.regkey = Software\FooSoftware\HtmlMerge
     myHtmlTool.priority = 1
 
   Supported arguments:
 
   priority;;
     The priority in which to evaluate this tool.
     Default: 0.
   executable;;
     Either just the name of the executable or its pathname.
     Default: the tool name.
   args;;
     The arguments to pass to the tool executable. You can refer to the files
     being merged as well as the output file through these variables: $base,
     $local, $other, $output.
     Default: $local $base $other
   premerge;;
     Attempt to run internal non-interactive 3-way merge tool before
     launching external tool.
     Default: True
   binary;;
     This tool can merge binary files. Defaults to False, unless tool
     was selected by file pattern match.
   symlink;;
     This tool can merge symlinks. Defaults to False, even if tool was
     selected by file pattern match.
   checkconflicts;;
     Check whether there are conflicts even though the tool reported
     success.
     Default: False
   checkchanged;;
     Check whether outputs were written even though the tool reported
     success.
     Default: False
   fixeol;;
     Attempt to fix up EOL changes caused by the merge tool.
     Default: False
   gui;;
     This tool requires a graphical interface to run. Default: False
   regkey;;
     Windows registry key which describes install location of this tool.
     Mercurial will search for this key first under HKEY_CURRENT_USER and
     then under HKEY_LOCAL_MACHINE. Default: None
   regname;;
     Name of value to read from specified registry key. Defaults to the
     unnamed (default) value.
   regappend;;
     String to append to the value read from the registry, typically the
     executable name of the tool. Default: None
 
 [[hooks]]
 hooks::
   Commands or Python functions that get automatically executed by
   various actions such as starting or finishing a commit. Multiple
   hooks can be run for the same action by appending a suffix to the
   action. Overriding a site-wide hook can be done by changing its
   value or setting it to an empty string.
 
   Example .hg/hgrc:
 
     [hooks]
     # do not use the site-wide hook
     incoming =
     incoming.email = /my/email/hook
     incoming.autobuild = /my/build/hook
 
   Most hooks are run with environment variables set that give added
   useful information. For each hook below, the environment variables
   it is passed are listed with names of the form "$HG_foo".
 
   changegroup;;
     Run after a changegroup has been added via push, pull or
     unbundle. ID of the first new changeset is in $HG_NODE. URL from
     which changes came is in $HG_URL.
   commit;;
     Run after a changeset has been created in the local repository.
     ID of the newly created changeset is in $HG_NODE. Parent
     changeset IDs are in $HG_PARENT1 and $HG_PARENT2.
   incoming;;
     Run after a changeset has been pulled, pushed, or unbundled into
     the local repository. The ID of the newly arrived changeset is in
     $HG_NODE. URL that was source of changes came is in $HG_URL.
   outgoing;;
     Run after sending changes from local repository to another. ID of
     first changeset sent is in $HG_NODE. Source of operation is in
     $HG_SOURCE; see "preoutgoing" hook for description.
   post-<command>;;
     Run after successful invocations of the associated command. The
     contents of the command line are passed as $HG_ARGS and the result
     code in $HG_RESULT. Hook failure is ignored.
   pre-<command>;;
     Run before executing the associated command. The contents of the
     command line are passed as $HG_ARGS. If the hook returns failure,
     the command doesn't execute and Mercurial returns the failure code.
   prechangegroup;;
     Run before a changegroup is added via push, pull or unbundle.
     Exit status 0 allows the changegroup to proceed. Non-zero status
     will cause the push, pull or unbundle to fail. URL from which
     changes will come is in $HG_URL.
   precommit;;
     Run before starting a local commit. Exit status 0 allows the
     commit to proceed. Non-zero status will cause the commit to fail.
     Parent changeset IDs are in $HG_PARENT1 and $HG_PARENT2.
   preoutgoing;;
     Run before collecting changes to send from the local repository to
     another. Non-zero status will cause failure. This lets you
     prevent pull over http or ssh. Also prevents against local pull,
     push (outbound) or bundle commands, but not effective, since you
     can just copy files instead then. Source of operation is in
     $HG_SOURCE. If "serve", operation is happening on behalf of
     remote ssh or http repository. If "push", "pull" or "bundle",
     operation is happening on behalf of repository on same system.
   pretag;;
     Run before creating a tag. Exit status 0 allows the tag to be
     created. Non-zero status will cause the tag to fail. ID of
     changeset to tag is in $HG_NODE. Name of tag is in $HG_TAG. Tag
     is local if $HG_LOCAL=1, in repo if $HG_LOCAL=0.
   pretxnchangegroup;;
     Run after a changegroup has been added via push, pull or unbundle,
     but before the transaction has been committed. Changegroup is
     visible to hook program. This lets you validate incoming changes
     before accepting them. Passed the ID of the first new changeset
     in $HG_NODE. Exit status 0 allows the transaction to commit.
     Non-zero status will cause the transaction to be rolled back and
     the push, pull or unbundle will fail. URL that was source of
     changes is in $HG_URL.
   pretxncommit;;
     Run after a changeset has been created but the transaction not yet
     committed. Changeset is visible to hook program. This lets you
     validate commit message and changes. Exit status 0 allows the
     commit to proceed. Non-zero status will cause the transaction to
     be rolled back. ID of changeset is in $HG_NODE. Parent changeset
     IDs are in $HG_PARENT1 and $HG_PARENT2.
   preupdate;;
     Run before updating the working directory. Exit status 0 allows
     the update to proceed. Non-zero status will prevent the update.
     Changeset ID of first new parent is in $HG_PARENT1. If merge, ID
     of second new parent is in $HG_PARENT2.
   tag;;
     Run after a tag is created. ID of tagged changeset is in
     $HG_NODE. Name of tag is in $HG_TAG. Tag is local if
     $HG_LOCAL=1, in repo if $HG_LOCAL=0.
   update;;
     Run after updating the working directory. Changeset ID of first
     new parent is in $HG_PARENT1. If merge, ID of second new parent
     is in $HG_PARENT2. If update succeeded, $HG_ERROR=0. If update
     failed (e.g. because conflicts not resolved), $HG_ERROR=1.
 
   Note: it is generally better to use standard hooks rather than the
   generic pre- and post- command hooks as they are guaranteed to be
   called in the appropriate contexts for influencing transactions.
   Also, hooks like "commit" will be called in all contexts that
   generate a commit (eg. tag) and not just the commit command.
 
   Note2: Environment variables with empty values may not be passed to
   hooks on platforms like Windows. For instance, $HG_PARENT2 will
   not be available under Windows for non-merge changesets while being
   set to an empty value under Unix-like systems.
 
   The syntax for Python hooks is as follows:
 
     hookname = python:modulename.submodule.callable
 
   Python hooks are run within the Mercurial process. Each hook is
   called with at least three keyword arguments: a ui object (keyword
   "ui"), a repository object (keyword "repo"), and a "hooktype"
   keyword that tells what kind of hook is used. Arguments listed as
   environment variables above are passed as keyword arguments, with no
   "HG_" prefix, and names in lower case.
 
   If a Python hook returns a "true" value or raises an exception, this
   is treated as failure of the hook.
 
 [[http_proxy]]
 http_proxy::
   Used to access web-based Mercurial repositories through a HTTP
   proxy.
   host;;
     Host name and (optional) port of the proxy server, for example
     "myproxy:8000".
   no;;
     Optional. Comma-separated list of host names that should bypass
     the proxy.
   passwd;;
     Optional. Password to authenticate with at the proxy server.
   user;;
     Optional. User name to authenticate with at the proxy server.
 
 [[smtp]]
 smtp::
   Configuration for extensions that need to send email messages.
   host;;
     Host name of mail server, e.g. "mail.example.com".
   port;;
     Optional. Port to connect to on mail server. Default: 25.
   tls;;
     Optional. Whether to connect to mail server using TLS. True or
     False. Default: False.
   username;;
     Optional. User name to authenticate to SMTP server with.
     If username is specified, password must also be specified.
     Default: none.
   password;;
     Optional. Password to authenticate to SMTP server with.
     If username is specified, password must also be specified.
     Default: none.
   local_hostname;;
     Optional. It's the hostname that the sender can use to identify itself
     to the MTA.
 
 [[paths]]
 paths::
   Assigns symbolic names to repositories. The left side is the
   symbolic name, and the right gives the directory or URL that is the
   location of the repository. Default paths can be declared by
   setting the following entries.
   default;;
     Directory or URL to use when pulling if no source is specified.
     Default is set to repository from which the current repository
     was cloned.
   default-push;;
     Optional. Directory or URL to use when pushing if no destination
     is specified.
 
 [[server]]
 server::
   Controls generic server settings.
   uncompressed;;
     Whether to allow clients to clone a repo using the uncompressed
     streaming protocol. This transfers about 40% more data than a
     regular clone, but uses less memory and CPU on both server and
     client. Over a LAN (100Mbps or better) or a very fast WAN, an
     uncompressed streaming clone is a lot faster (~10x) than a regular
     clone. Over most WAN connections (anything slower than about
     6Mbps), uncompressed streaming is slower, because of the extra
     data transfer overhead. Default is False.
 
 [[trusted]]
 trusted::
   For security reasons, Mercurial will not use the settings in
   the .hg/hgrc file from a repository if it doesn't belong to a
   trusted user or to a trusted group. The main exception is the
   web interface, which automatically uses some safe settings, since
   it's common to serve repositories from different users.
 
   This section specifies what users and groups are trusted. The
   current user is always trusted. To trust everybody, list a user
   or a group with name "*".
 
   users;;
     Comma-separated list of trusted users.
   groups;;
     Comma-separated list of trusted groups.
 
 [[ui]]
 ui::
   User interface controls.
   archivemeta;;
     Whether to include the .hg_archival.txt file containing metadata
     (hashes for the repository base and for tip) in archives created by
     the hg archive command or downloaded via hgweb.
     Default is true.
   askusername;;
     Whether to prompt for a username when committing. If True, and
     neither $HGUSER nor $EMAIL has been specified, then the user will
     be prompted to enter a username.  If no username is entered, the
     default USER@HOST is used instead.
     Default is False.
   debug;;
     Print debugging information. True or False. Default is False.
   editor;;
     The editor to use during a commit. Default is $EDITOR or "vi".
   fallbackencoding;;
     Encoding to try if it's not possible to decode the changelog using
     UTF-8. Default is ISO-8859-1.
   ignore;;
     A file to read per-user ignore patterns from. This file should be in
     the same format as a repository-wide .hgignore file. This option
     supports hook syntax, so if you want to specify multiple ignore
     files, you can do so by setting something like
     "ignore.other = ~/.hgignore2". For details of the ignore file
     format, see the hgignore(5) man page.
   interactive;;
     Allow to prompt the user. True or False. Default is True.
   logtemplate;;
     Template string for commands that print changesets.
   merge;;
     The conflict resolution program to use during a manual merge.
     There are some internal tools available:
 
       internal:local;;
         keep the local version
       internal:other;;
         use the other version
       internal:merge;;
         use the internal non-interactive merge tool
       internal:fail;;
         fail to merge
 
     See the merge-tools section for more information on configuring tools.
 
   patch;;
     command to use to apply patches. Look for 'gpatch' or 'patch' in PATH if
     unset.
   quiet;;
     Reduce the amount of output printed. True or False. Default is False.
   remotecmd;;
     remote command to use for clone/push/pull operations. Default is 'hg'.
   report_untrusted;;
     Warn if a .hg/hgrc file is ignored due to not being owned by a
     trusted user or group. True or False. Default is True.
   slash;;
     Display paths using a slash ("/") as the path separator. This only
     makes a difference on systems where the default path separator is not
     the slash character (e.g. Windows uses the backslash character ("\")).
     Default is False.
   ssh;;
     command to use for SSH connections. Default is 'ssh'.
   strict;;
     Require exact command names, instead of allowing unambiguous
     abbreviations. True or False. Default is False.
   style;;
     Name of style to use for command output.
   timeout;;
     The timeout used when a lock is held (in seconds), a negative value
     means no timeout. Default is 600.
   username;;
     The committer of a changeset created when running "commit".
     Typically a person's name and email address, e.g. "Fred Widget
     <[e-mail]>". Default is $EMAIL or username@hostname.
     If the username in hgrc is empty, it has to be specified manually or
     in a different hgrc file (e.g. $HOME/.hgrc, if the admin set "username ="
     in the system hgrc).
   verbose;;
     Increase the amount of output printed. True or False. Default is False.
 
 
 [[web]]
 web::
   Web interface configuration.
   accesslog;;
     Where to output the access log. Default is stdout.
   address;;
     Interface address to bind to. Default is all.
   allow_archive;;
     List of archive format (bz2, gz, zip) allowed for downloading.
     Default is empty.
   allowbz2;;
     (DEPRECATED) Whether to allow .tar.bz2 downloading of repo revisions.
     Default is false.
   allowgz;;
     (DEPRECATED) Whether to allow .tar.gz downloading of repo revisions.
     Default is false.
   allowpull;;
     Whether to allow pulling from the repository. Default is true.
   allow_push;;
     Whether to allow pushing to the repository. If empty or not set,
     push is not allowed. If the special value "*", any remote user
     can push, including unauthenticated users. Otherwise, the remote
     user must have been authenticated, and the authenticated user name
     must be present in this list (separated by whitespace or ",").
     The contents of the allow_push list are examined after the
     deny_push list.
+  allow_read;;
+    If the user has not already been denied repository access due to the
+    contents of deny_read, this list determines whether to grant repository
+    access to the user. If this list is not empty, and the user is
+    unauthenticated or not present in the list (separated by whitespace or ","),
+    then access is denied for the user.  If the list is empty or not set, then
+    access is permitted to all users by default.  Setting allow_read to the
+    special value "*" is equivalent to it not being set (i.e. access is
+    permitted to all users).  The contents of the allow_read list are examined
+    after the deny_read list.
   allowzip;;
     (DEPRECATED) Whether to allow .zip downloading of repo revisions.
     Default is false. This feature creates temporary files.
   baseurl;;
     Base URL to use when publishing URLs in other locations, so
     third-party tools like email notification hooks can construct URLs.
     Example: "http://hgserver/repos/"
   contact;;
     Name or email address of the person in charge of the repository.
     Defaults to ui.username or $EMAIL or "unknown" if unset or empty.
   deny_push;;
     Whether to deny pushing to the repository. If empty or not set,
     push is not denied. If the special value "*", all remote users
     are denied push. Otherwise, unauthenticated users are all denied,
     and any authenticated user name present in this list (separated by
     whitespace or ",") is also denied. The contents of the deny_push
     list are examined before the allow_push list.
+  deny_read;;
+    Whether to deny reading/viewing of the repository.  If this list is not
+    empty, unauthenticated users are all denied, and any authenticated user name
+    present in this list (separated by whitespace or ",") is also denied access
+    to the repository.  If set to the special value "*", all remote users are
+    denied access (rarely needed ;).  If deny_read is empty or not set, the
+    determination of repository access depends on the presence and content of
+    the allow_read list (see description).  If both deny_read and allow_read are
+    empty or not set, then access is permitted to all users by default.  If the
+    repository is being served via hgwebdir, denied users will not be able to
+    see it in the list of repositories.  The contents of the deny_read list have
+    priority over (are examined before) the contents of the allow_read list.
   description;;
     Textual description of the repository's purpose or contents.
     Default is "unknown".
   encoding;;
     Character encoding name.
     Example: "UTF-8"
   errorlog;;
     Where to output the error log. Default is stderr.
   hidden;;
     Whether to hide the repository in the hgwebdir index. Default is false.
   ipv6;;
     Whether to use IPv6. Default is false.
   name;;
     Repository name to use in the web interface. Default is current
     working directory.
   maxchanges;;
     Maximum number of changes to list on the changelog. Default is 10.
   maxfiles;;
     Maximum number of files to list per changeset. Default is 10.
   port;;
     Port to listen on. Default is 8000.
   prefix;;
     Prefix path to serve from. Default is '' (server root).
   push_ssl;;
     Whether to require that inbound pushes be transported over SSL to
     prevent password sniffing. Default is true.
   staticurl;;
     Base URL to use for static files. If unset, static files (e.g.
     the hgicon.png favicon) will be served by the CGI script itself.
     Use this setting to serve them directly with the HTTP server.
     Example: "http://hgserver/static/"
   stripes;;
     How many lines a "zebra stripe" should span in multiline output.
     Default is 1; set to 0 to disable.
   style;;
     Which template map style to use.
   templates;;
     Where to find the HTML templates. Default is install path.
 
 
 AUTHOR
 ------
 Bryan O'Sullivan <[e-mail]>.
 
 Mercurial was written by Matt Mackall <[e-mail]>.
 
 SEE ALSO
 --------
 hg(1), hgignore(5)
 
 COPYING
 -------
 This manual page is copyright 2005 Bryan O'Sullivan.
 Mercurial is copyright 2005-2007 Matt Mackall.
 Free use of this software is granted under the terms of the GNU General
 Public License (GPL).

mercurial/hgweb/hgweb_mod.py

@@ -1,308 +1,321 b''
 # hgweb/hgweb_mod.py - Web interface for a repository.
 #
 # Copyright 21 May 2005 - (c) 2005 Jake Edge <[e-mail]>
 # Copyright 2005-2007 Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms
 # of the GNU General Public License, incorporated herein by reference.
 
 import os, mimetypes
 from mercurial.node import hex, nullid
 from mercurial.repo import RepoError
 from mercurial import ui, hg, util, hook
 from mercurial import revlog, templater, templatefilters
 from common import get_mtime, style_map, ErrorResponse
 from common import HTTP_OK, HTTP_BAD_REQUEST, HTTP_NOT_FOUND, HTTP_SERVER_ERROR
 from common import HTTP_UNAUTHORIZED, HTTP_METHOD_NOT_ALLOWED
 from request import wsgirequest
 import webcommands, protocol, webutil
 
 perms = {
     'changegroup': 'pull',
     'changegroupsubset': 'pull',
     'unbundle': 'push',
     'stream_out': 'pull',
 }
 
 class hgweb(object):
     def __init__(self, repo, name=None):
         if isinstance(repo, str):
             parentui = ui.ui(report_untrusted=False, interactive=False)
             self.repo = hg.repository(parentui, repo)
         else:
             self.repo = repo
 
         hook.redirect(True)
         self.mtime = -1
         self.reponame = name
         self.archives = 'zip', 'gz', 'bz2'
         self.stripecount = 1
         # a repo owner may set web.templates in .hg/hgrc to get any file
         # readable by the user running the CGI script
         self.templatepath = self.config("web", "templates",
                                         templater.templatepath(),
                                         untrusted=False)
 
     # The CGI scripts are often run by a user different from the repo owner.
     # Trust the settings from the .hg/hgrc files by default.
     def config(self, section, name, default=None, untrusted=True):
         return self.repo.ui.config(section, name, default,
                                    untrusted=untrusted)
 
     def configbool(self, section, name, default=False, untrusted=True):
         return self.repo.ui.configbool(section, name, default,
                                        untrusted=untrusted)
 
     def configlist(self, section, name, default=None, untrusted=True):
         return self.repo.ui.configlist(section, name, default,
                                        untrusted=untrusted)
 
     def refresh(self):
         mtime = get_mtime(self.repo.root)
         if mtime != self.mtime:
             self.mtime = mtime
             self.repo = hg.repository(self.repo.ui, self.repo.root)
             self.maxchanges = int(self.config("web", "maxchanges", 10))
             self.stripecount = int(self.config("web", "stripes", 1))
             self.maxshortchanges = int(self.config("web", "maxshortchanges", 60))
             self.maxfiles = int(self.config("web", "maxfiles", 10))
             self.allowpull = self.configbool("web", "allowpull", True)
             self.encoding = self.config("web", "encoding", util._encoding)
 
     def run(self):
         if not os.environ.get('GATEWAY_INTERFACE', '').startswith("CGI/1."):
             raise RuntimeError("This function is only intended to be called while running as a CGI script.")
         import mercurial.hgweb.wsgicgi as wsgicgi
         wsgicgi.launch(self)
 
     def __call__(self, env, respond):
         req = wsgirequest(env, respond)
         return self.run_wsgi(req)
 
     def run_wsgi(self, req):
 
         self.refresh()
 
         # process this if it's a protocol request
         # protocol bits don't need to create any URLs
         # and the clients always use the old URL structure
 
         cmd = req.form.get('cmd', [''])[0]
         if cmd and cmd in protocol.__all__:
             try:
                 if cmd in perms:
                     try:
                         self.check_perm(req, perms[cmd])
                     except ErrorResponse, inst:
                         if cmd == 'unbundle':
                             req.drain()
                         raise
                 method = getattr(protocol, cmd)
                 return method(self.repo, req)
             except ErrorResponse, inst:
                 req.respond(inst.code, protocol.HGTYPE)
                 if not inst.message:
                     return []
                 return '0\n%s\n' % inst.message,
 
         # work with CGI variables to create coherent structure
         # use SCRIPT_NAME, PATH_INFO and QUERY_STRING as well as our REPO_NAME
 
         req.url = req.env['SCRIPT_NAME']
         if not req.url.endswith('/'):
             req.url += '/'
         if 'REPO_NAME' in req.env:
             req.url += req.env['REPO_NAME'] + '/'
 
         if 'PATH_INFO' in req.env:
             parts = req.env['PATH_INFO'].strip('/').split('/')
             repo_parts = req.env.get('REPO_NAME', '').split('/')
             if parts[:len(repo_parts)] == repo_parts:
                 parts = parts[len(repo_parts):]
             query = '/'.join(parts)
         else:
             query = req.env['QUERY_STRING'].split('&', 1)[0]
             query = query.split(';', 1)[0]
 
         # translate user-visible url structure to internal structure
 
         args = query.split('/', 2)
         if 'cmd' not in req.form and args and args[0]:
 
             cmd = args.pop(0)
             style = cmd.rfind('-')
             if style != -1:
                 req.form['style'] = [cmd[:style]]
                 cmd = cmd[style+1:]
 
             # avoid accepting e.g. style parameter as command
             if hasattr(webcommands, cmd):
                 req.form['cmd'] = [cmd]
             else:
                 cmd = ''
 
             if cmd == 'static':
                 req.form['file'] = ['/'.join(args)]
             else:
                 if args and args[0]:
                     node = args.pop(0)
                     req.form['node'] = [node]
                 if args:
                     req.form['file'] = args
 
             if cmd == 'archive':
                 fn = req.form['node'][0]
                 for type_, spec in self.archive_specs.iteritems():
                     ext = spec[2]
                     if fn.endswith(ext):
                         req.form['node'] = [fn[:-len(ext)]]
                         req.form['type'] = [type_]
 
         # process the web interface request
 
         try:
-
             tmpl = self.templater(req)
             ctype = tmpl('mimetype', encoding=self.encoding)
             ctype = templater.stringify(ctype)
 
+            # check allow_read / deny_read config options
+            self.check_perm(req, None)
+
             if cmd == '':
                 req.form['cmd'] = [tmpl.cache['default']]
                 cmd = req.form['cmd'][0]
 
             if cmd not in webcommands.__all__:
                 msg = 'no such method: %s' % cmd
                 raise ErrorResponse(HTTP_BAD_REQUEST, msg)
             elif cmd == 'file' and 'raw' in req.form.get('style', []):
                 self.ctype = ctype
                 content = webcommands.rawfile(self, req, tmpl)
             else:
                 content = getattr(webcommands, cmd)(self, req, tmpl)
                 req.respond(HTTP_OK, ctype)
 
             return ''.join(content),
 
         except revlog.LookupError, err:
             req.respond(HTTP_NOT_FOUND, ctype)
             msg = str(err)
             if 'manifest' not in msg:
                 msg = 'revision not found: %s' % err.name
             return ''.join(tmpl('error', error=msg)),
         except (RepoError, revlog.RevlogError), inst:
             req.respond(HTTP_SERVER_ERROR, ctype)
             return ''.join(tmpl('error', error=str(inst))),
         except ErrorResponse, inst:
             req.respond(inst.code, ctype)
             return ''.join(tmpl('error', error=inst.message)),
 
     def templater(self, req):
 
         # determine scheme, port and server name
         # this is needed to create absolute urls
 
         proto = req.env.get('wsgi.url_scheme')
         if proto == 'https':
             proto = 'https'
             default_port = "443"
         else:
             proto = 'http'
             default_port = "80"
 
         port = req.env["SERVER_PORT"]
         port = port != default_port and (":" + port) or ""
         urlbase = '%s://%s%s' % (proto, req.env['SERVER_NAME'], port)
         staticurl = self.config("web", "staticurl") or req.url + 'static/'
         if not staticurl.endswith('/'):
             staticurl += '/'
 
         # some functions for the templater
 
         def header(**map):
             yield tmpl('header', encoding=self.encoding, **map)
 
         def footer(**map):
             yield tmpl("footer", **map)
 
         def motd(**map):
             yield self.config("web", "motd", "")
 
         def sessionvars(**map):
             fields = []
             if 'style' in req.form:
                 style = req.form['style'][0]
                 if style != self.config('web', 'style', ''):
                     fields.append(('style', style))
 
             separator = req.url[-1] == '?' and ';' or '?'
             for name, value in fields:
                 yield dict(name=name, value=value, separator=separator)
                 separator = ';'
 
         # figure out which style to use
 
         style = self.config("web", "style", "")
         if 'style' in req.form:
             style = req.form['style'][0]
         mapfile = style_map(self.templatepath, style)
 
         if not self.reponame:
             self.reponame = (self.config("web", "name")
                              or req.env.get('REPO_NAME')
                              or req.url.strip('/') or self.repo.root)
 
         # create the templater
 
         tmpl = templater.templater(mapfile, templatefilters.filters,
                                    defaults={"url": req.url,
                                              "staticurl": staticurl,
                                              "urlbase": urlbase,
                                              "repo": self.reponame,
                                              "header": header,
                                              "footer": footer,
                                              "motd": motd,
                                              "sessionvars": sessionvars
                                             })
         return tmpl
 
     def archivelist(self, nodeid):
         allowed = self.configlist("web", "allow_archive")
         for i, spec in self.archive_specs.iteritems():
             if i in allowed or self.configbool("web", "allow" + i):
                 yield {"type" : i, "extension" : spec[2], "node" : nodeid}
 
     archive_specs = {
         'bz2': ('application/x-tar', 'tbz2', '.tar.bz2', None),
         'gz': ('application/x-tar', 'tgz', '.tar.gz', None),
         'zip': ('application/zip', 'zip', '.zip', None),
         }
 
     def check_perm(self, req, op):
         '''Check permission for operation based on request data (including
-        authentication info. Return true if op allowed, else false.'''
+        authentication info). Return if op allowed, else raise an ErrorResponse
+        exception.'''
+
+        user = req.env.get('REMOTE_USER')
+
+        deny_read = self.configlist('web', 'deny_read')
+        if deny_read and (not user or deny_read == ['*'] or user in deny_read):
+            raise ErrorResponse(HTTP_UNAUTHORIZED, 'read not authorized')
+
+        allow_read = self.configlist('web', 'allow_read')
+        result = (not allow_read) or (allow_read == ['*']) or (user in allow_read)
+        if not result:
+            raise ErrorResponse(HTTP_UNAUTHORIZED, 'read not authorized')
 
         if op == 'pull' and not self.allowpull:
             raise ErrorResponse(HTTP_OK, '')
-        elif op == 'pull':
+        # op is None when checking allow/deny_read permissions for a web-browser request
+        elif op == 'pull' or op is None:
             return
 
         # enforce that you can only push using POST requests
         if req.env['REQUEST_METHOD'] != 'POST':
             msg = 'push requires POST request'
             raise ErrorResponse(HTTP_METHOD_NOT_ALLOWED, msg)
 
         # require ssl by default for pushing, auth info cannot be sniffed
         # and replayed
         scheme = req.env.get('wsgi.url_scheme')
         if self.configbool('web', 'push_ssl', True) and scheme != 'https':
             raise ErrorResponse(HTTP_OK, 'ssl required')
 
-        user = req.env.get('REMOTE_USER')
-
         deny = self.configlist('web', 'deny_push')
         if deny and (not user or deny == ['*'] or user in deny):
             raise ErrorResponse(HTTP_UNAUTHORIZED, 'push not authorized')
 
         allow = self.configlist('web', 'allow_push')
         result = allow and (allow == ['*'] or user in allow)
         if not result:
             raise ErrorResponse(HTTP_UNAUTHORIZED, 'push not authorized')

mercurial/hgweb/hgwebdir_mod.py

@@ -1,284 +1,309 b''
 # hgweb/hgwebdir_mod.py - Web interface for a directory of repositories.
 #
 # Copyright 21 May 2005 - (c) 2005 Jake Edge <[e-mail]>
 # Copyright 2005, 2006 Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms
 # of the GNU General Public License, incorporated herein by reference.
 
 import os
 from mercurial.i18n import _
 from mercurial.repo import RepoError
 from mercurial import ui, hg, util, templater, templatefilters
 from common import ErrorResponse, get_mtime, staticfile, style_map, paritygen,\
                    get_contact, HTTP_OK, HTTP_NOT_FOUND, HTTP_SERVER_ERROR
 from hgweb_mod import hgweb
 from request import wsgirequest
 
 # This is a stopgap
 class hgwebdir(object):
     def __init__(self, config, parentui=None):
         def cleannames(items):
             return [(util.pconvert(name).strip('/'), path)
                     for name, path in items]
 
         self.parentui = parentui or ui.ui(report_untrusted=False,
                                           interactive = False)
         self.motd = None
         self.style = None
         self.stripecount = None
         self.repos_sorted = ('name', False)
         self._baseurl = None
         if isinstance(config, (list, tuple)):
             self.repos = cleannames(config)
             self.repos_sorted = ('', False)
         elif isinstance(config, dict):
             self.repos = util.sort(cleannames(config.items()))
         else:
             if isinstance(config, util.configparser):
                 cp = config
             else:
                 cp = util.configparser()
                 cp.read(config)
             self.repos = []
             if cp.has_section('web'):
                 if cp.has_option('web', 'motd'):
                     self.motd = cp.get('web', 'motd')
                 if cp.has_option('web', 'style'):
                     self.style = cp.get('web', 'style')
                 if cp.has_option('web', 'stripes'):
                     self.stripecount = int(cp.get('web', 'stripes'))
                 if cp.has_option('web', 'baseurl'):
                     self._baseurl = cp.get('web', 'baseurl')
             if cp.has_section('paths'):
                 self.repos.extend(cleannames(cp.items('paths')))
             if cp.has_section('collections'):
                 for prefix, root in cp.items('collections'):
                     for path in util.walkrepos(root, followsym=True):
                         repo = os.path.normpath(path)
                         name = repo
                         if name.startswith(prefix):
                             name = name[len(prefix):]
                         self.repos.append((name.lstrip(os.sep), repo))
             self.repos.sort()
 
     def run(self):
         if not os.environ.get('GATEWAY_INTERFACE', '').startswith("CGI/1."):
             raise RuntimeError("This function is only intended to be called while running as a CGI script.")
         import mercurial.hgweb.wsgicgi as wsgicgi
         wsgicgi.launch(self)
 
     def __call__(self, env, respond):
         req = wsgirequest(env, respond)
         return self.run_wsgi(req)
 
+    def read_allowed(self, ui, req):
+        """Check allow_read and deny_read config options of a repo's ui object
+        to determine user permissions.  By default, with neither option set (or
+        both empty), allow all users to read the repo.  There are two ways a
+        user can be denied read access:  (1) deny_read is not empty, and the
+        user is unauthenticated or deny_read contains user (or *), and (2)
+        allow_read is not empty and the user is not in allow_read.  Return True
+        if user is allowed to read the repo, else return False."""
+
+        user = req.env.get('REMOTE_USER')
+
+        deny_read = ui.configlist('web', 'deny_read', default=None, untrusted=True)
+        if deny_read and (not user or deny_read == ['*'] or user in deny_read):
+            return False
+
+        allow_read = ui.configlist('web', 'allow_read', default=None, untrusted=True)
+        # by default, allow reading if no allow_read option has been set
+        if (not allow_read) or (allow_read == ['*']) or (user in allow_read):
+            return True
+
+        return False
+
     def run_wsgi(self, req):
 
         try:
             try:
 
                 virtual = req.env.get("PATH_INFO", "").strip('/')
                 tmpl = self.templater(req)
                 ctype = tmpl('mimetype', encoding=util._encoding)
                 ctype = templater.stringify(ctype)
 
                 # a static file
                 if virtual.startswith('static/') or 'static' in req.form:
                     if virtual.startswith('static/'):
                         fname = virtual[7:]
                     else:
                         fname = req.form['static'][0]
                     static = templater.templatepath('static')
                     return staticfile(static, fname, req)
 
                 # top-level index
                 elif not virtual:
                     req.respond(HTTP_OK, ctype)
                     return ''.join(self.makeindex(req, tmpl)),
 
                 # nested indexes and hgwebs
 
                 repos = dict(self.repos)
                 while virtual:
                     real = repos.get(virtual)
                     if real:
                         req.env['REPO_NAME'] = virtual
                         try:
                             repo = hg.repository(self.parentui, real)
                             return hgweb(repo).run_wsgi(req)
                         except IOError, inst:
                             msg = inst.strerror
                             raise ErrorResponse(HTTP_SERVER_ERROR, msg)
                         except RepoError, inst:
                             raise ErrorResponse(HTTP_SERVER_ERROR, str(inst))
 
                     # browse subdirectories
                     subdir = virtual + '/'
                     if [r for r in repos if r.startswith(subdir)]:
                         req.respond(HTTP_OK, ctype)
                         return ''.join(self.makeindex(req, tmpl, subdir)),
 
                     up = virtual.rfind('/')
                     if up < 0:
                         break
                     virtual = virtual[:up]
 
                 # prefixes not found
                 req.respond(HTTP_NOT_FOUND, ctype)
                 return ''.join(tmpl("notfound", repo=virtual)),
 
             except ErrorResponse, err:
                 req.respond(err.code, ctype)
                 return ''.join(tmpl('error', error=err.message or '')),
         finally:
             tmpl = None
 
     def makeindex(self, req, tmpl, subdir=""):
 
         def archivelist(ui, nodeid, url):
             allowed = ui.configlist("web", "allow_archive", untrusted=True)
             for i in [('zip', '.zip'), ('gz', '.tar.gz'), ('bz2', '.tar.bz2')]:
                 if i[0] in allowed or ui.configbool("web", "allow" + i[0],
                                                     untrusted=True):
                     yield {"type" : i[0], "extension": i[1],
                            "node": nodeid, "url": url}
 
         def entries(sortcolumn="", descending=False, subdir="", **map):
             def sessionvars(**map):
                 fields = []
                 if 'style' in req.form:
                     style = req.form['style'][0]
                     if style != get('web', 'style', ''):
                         fields.append(('style', style))
 
                 separator = url[-1] == '?' and ';' or '?'
                 for name, value in fields:
                     yield dict(name=name, value=value, separator=separator)
                     separator = ';'
 
             rows = []
             parity = paritygen(self.stripecount)
             for name, path in self.repos:
                 if not name.startswith(subdir):
                     continue
                 name = name[len(subdir):]
 
                 u = ui.ui(parentui=self.parentui)
                 try:
                     u.readconfig(os.path.join(path, '.hg', 'hgrc'))
                 except Exception, e:
                     u.warn(_('error reading %s/.hg/hgrc: %s\n') % (path, e))
                     continue
                 def get(section, name, default=None):
                     return u.config(section, name, default, untrusted=True)
 
                 if u.configbool("web", "hidden", untrusted=True):
                     continue
 
+                if not self.read_allowed(u, req):
+                    continue
+
                 parts = [name]
                 if 'PATH_INFO' in req.env:
                     parts.insert(0, req.env['PATH_INFO'].rstrip('/'))
                 if req.env['SCRIPT_NAME']:
                     parts.insert(0, req.env['SCRIPT_NAME'])
                 url = ('/'.join(parts).replace("//", "/")) + '/'
 
                 # update time with local timezone
                 try:
                     d = (get_mtime(path), util.makedate()[1])
                 except OSError:
                     continue
 
                 contact = get_contact(get)
                 description = get("web", "description", "")
                 name = get("web", "name", name)
                 row = dict(contact=contact or "unknown",
                            contact_sort=contact.upper() or "unknown",
                            name=name,
                            name_sort=name,
                            url=url,
                            description=description or "unknown",
                            description_sort=description.upper() or "unknown",
                            lastchange=d,
                            lastchange_sort=d[1]-d[0],
                            sessionvars=sessionvars,
                            archives=archivelist(u, "tip", url))
                 if (not sortcolumn
                     or (sortcolumn, descending) == self.repos_sorted):
                     # fast path for unsorted output
                     row['parity'] = parity.next()
                     yield row
                 else:
                     rows.append((row["%s_sort" % sortcolumn], row))
             if rows:
                 rows.sort()
                 if descending:
                     rows.reverse()
                 for key, row in rows:
                     row['parity'] = parity.next()
                     yield row
 
         sortable = ["name", "description", "contact", "lastchange"]
         sortcolumn, descending = self.repos_sorted
         if 'sort' in req.form:
             sortcolumn = req.form['sort'][0]
             descending = sortcolumn.startswith('-')
             if descending:
                 sortcolumn = sortcolumn[1:]
             if sortcolumn not in sortable:
                 sortcolumn = ""
 
         sort = [("sort_%s" % column,
                  "%s%s" % ((not descending and column == sortcolumn)
                             and "-" or "", column))
                 for column in sortable]
 
         if self._baseurl is not None:
             req.env['SCRIPT_NAME'] = self._baseurl
 
         return tmpl("index", entries=entries, subdir=subdir,
                     sortcolumn=sortcolumn, descending=descending,
                     **dict(sort))
 
     def templater(self, req):
 
         def header(**map):
             yield tmpl('header', encoding=util._encoding, **map)
 
         def footer(**map):
             yield tmpl("footer", **map)
 
         def motd(**map):
             if self.motd is not None:
                 yield self.motd
             else:
                 yield config('web', 'motd', '')
 
         def config(section, name, default=None, untrusted=True):
             return self.parentui.config(section, name, default, untrusted)
 
         if self._baseurl is not None:
             req.env['SCRIPT_NAME'] = self._baseurl
 
         url = req.env.get('SCRIPT_NAME', '')
         if not url.endswith('/'):
             url += '/'
 
         staticurl = config('web', 'staticurl') or url + 'static/'
         if not staticurl.endswith('/'):
             staticurl += '/'
 
         style = self.style
         if style is None:
             style = config('web', 'style', '')
         if 'style' in req.form:
             style = req.form['style'][0]
         if self.stripecount is None:
             self.stripecount = int(config('web', 'stripes', 1))
         mapfile = style_map(templater.templatepath(), style)
         tmpl = templater.templater(mapfile, templatefilters.filters,
                                    defaults={"header": header,
                                              "footer": footer,
                                              "motd": motd,
                                              "url": url,
                                              "staticurl": staticurl})
         return tmpl