acl: support for getting authenticated user from web server (issue298)

Previously, the acl extension just read the current system user, which
is fine for direct file system access and SSH, but will not work for
HTTP(S) as that would return the web server process user identity
rather than the authenticated user. An empty user is returned if the
user is not authenticated.

hgext/acl.py

@@ -1,91 +1,99 b''
 # acl.py - changeset access control for mercurial
 #
 # Copyright 2006 Vadim Gelfer <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2, incorporated herein by reference.
 #
 # this hook allows to allow or deny access to parts of a repo when
 # taking incoming changesets.
 #
 # authorization is against local user name on system where hook is
 # run, not committer of original changeset (since that is easy to
 # spoof).
 #
 # acl hook is best to use if you use hgsh to set up restricted shells
 # for authenticated users to only push to / pull from.  not safe if
 # user has interactive shell access, because they can disable hook.
 # also not safe if remote users share one local account, because then
 # no way to tell remote users apart.
 #
 # to use, configure acl extension in hgrc like this:
 #
 #   [extensions]
 #   hgext.acl =
 #
 #   [hooks]
 #   pretxnchangegroup.acl = python:hgext.acl.hook
 #
 #   [acl]
 #   sources = serve        # check if source of incoming changes in this list
 #                          # ("serve" == ssh or http, "push", "pull", "bundle")
 #
 # allow and deny lists have subtree pattern (default syntax is glob)
 # on left, user names on right. deny list checked before allow list.
 #
 #   [acl.allow]
 #   # if acl.allow not present, all users allowed by default
 #   # empty acl.allow = no users allowed
 #   docs/** = doc_writer
 #   .hgtags = release_engineer
 #
 #   [acl.deny]
 #   # if acl.deny not present, no users denied by default
 #   # empty acl.deny = all users allowed
 #   glob pattern = user4, user5
 #   ** = user6
 
 from mercurial.i18n import _
 from mercurial import util, match
-import getpass
+import getpass, urllib
 
 def buildmatch(ui, repo, user, key):
     '''return tuple of (match function, list enabled).'''
     if not ui.has_section(key):
         ui.debug(_('acl: %s not enabled\n') % key)
         return None
 
     pats = [pat for pat, users in ui.configitems(key)
             if user in users.replace(',', ' ').split()]
     ui.debug(_('acl: %s enabled, %d entries for user %s\n') %
              (key, len(pats), user))
     if pats:
         return match.match(repo.root, '', pats)
     return match.exact(repo.root, '', [])
 
 
 def hook(ui, repo, hooktype, node=None, source=None, **kwargs):
     if hooktype != 'pretxnchangegroup':
         raise util.Abort(_('config error - hook type "%s" cannot stop '
                            'incoming changesets') % hooktype)
     if source not in ui.config('acl', 'sources', 'serve').split():
         ui.debug(_('acl: changes have source "%s" - skipping\n') % source)
         return
 
+    user = None
+    if source == 'serve' and 'url' in kwargs:
+        url = kwargs['url'].split(':')
+        if url[0] == 'remote' and url[1].startswith('http'):
+            user = urllib.unquote(url[2])
+
+    if user is None:
     user = getpass.getuser()
+
     cfg = ui.config('acl', 'config')
     if cfg:
         ui.readconfig(cfg, sections = ['acl.allow', 'acl.deny'])
     allow = buildmatch(ui, repo, user, 'acl.allow')
     deny = buildmatch(ui, repo, user, 'acl.deny')
 
     for rev in xrange(repo[node], len(repo)):
         ctx = repo[rev]
         for f in ctx.files():
             if deny and deny(f):
                 ui.debug(_('acl: user %s denied on %s\n') % (user, f))
                 raise util.Abort(_('acl: access denied for changeset %s') % ctx)
             if allow and not allow(f):
                 ui.debug(_('acl: user %s not allowed on %s\n') % (user, f))
                 raise util.Abort(_('acl: access denied for changeset %s') % ctx)
         ui.debug(_('acl: allowing changeset %s\n') % ctx)

mercurial/hgweb/protocol.py

@@ -1,205 +1,206 b''
 #
 # Copyright 21 May 2005 - (c) 2005 Jake Edge <[e-mail]>
 # Copyright 2005-2007 Matt Mackall <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2, incorporated herein by reference.
 
 import cStringIO, zlib, tempfile, errno, os, sys, urllib
 from mercurial import util, streamclone
 from mercurial.node import bin, hex
 from mercurial import changegroup as changegroupmod
 from common import ErrorResponse, HTTP_OK, HTTP_NOT_FOUND, HTTP_SERVER_ERROR
 
 # __all__ is populated with the allowed commands. Be sure to add to it if
 # you're adding a new command, or the new command won't work.
 
 __all__ = [
    'lookup', 'heads', 'branches', 'between', 'changegroup',
    'changegroupsubset', 'capabilities', 'unbundle', 'stream_out',
    'branchmap',
 ]
 
 HGTYPE = 'application/mercurial-0.1'
 
 def lookup(repo, req):
     try:
         r = hex(repo.lookup(req.form['key'][0]))
         success = 1
     except Exception,inst:
         r = str(inst)
         success = 0
     resp = "%s %s\n" % (success, r)
     req.respond(HTTP_OK, HGTYPE, length=len(resp))
     yield resp
 
 def heads(repo, req):
     resp = " ".join(map(hex, repo.heads())) + "\n"
     req.respond(HTTP_OK, HGTYPE, length=len(resp))
     yield resp
 
 def branchmap(repo, req):
     branches = repo.branchmap()
     heads = []
     for branch, nodes in branches.iteritems():
         branchname = urllib.quote(branch)
         branchnodes = [hex(node) for node in nodes]
         heads.append('%s %s' % (branchname, ' '.join(branchnodes)))
     resp = '\n'.join(heads)
     req.respond(HTTP_OK, HGTYPE, length=len(resp))
     yield resp
 
 def branches(repo, req):
     nodes = []
     if 'nodes' in req.form:
         nodes = map(bin, req.form['nodes'][0].split(" "))
     resp = cStringIO.StringIO()
     for b in repo.branches(nodes):
         resp.write(" ".join(map(hex, b)) + "\n")
     resp = resp.getvalue()
     req.respond(HTTP_OK, HGTYPE, length=len(resp))
     yield resp
 
 def between(repo, req):
     if 'pairs' in req.form:
         pairs = [map(bin, p.split("-"))
                  for p in req.form['pairs'][0].split(" ")]
     resp = cStringIO.StringIO()
     for b in repo.between(pairs):
         resp.write(" ".join(map(hex, b)) + "\n")
     resp = resp.getvalue()
     req.respond(HTTP_OK, HGTYPE, length=len(resp))
     yield resp
 
 def changegroup(repo, req):
     req.respond(HTTP_OK, HGTYPE)
     nodes = []
 
     if 'roots' in req.form:
         nodes = map(bin, req.form['roots'][0].split(" "))
 
     z = zlib.compressobj()
     f = repo.changegroup(nodes, 'serve')
     while 1:
         chunk = f.read(4096)
         if not chunk:
             break
         yield z.compress(chunk)
 
     yield z.flush()
 
 def changegroupsubset(repo, req):
     req.respond(HTTP_OK, HGTYPE)
     bases = []
     heads = []
 
     if 'bases' in req.form:
         bases = [bin(x) for x in req.form['bases'][0].split(' ')]
     if 'heads' in req.form:
         heads = [bin(x) for x in req.form['heads'][0].split(' ')]
 
     z = zlib.compressobj()
     f = repo.changegroupsubset(bases, heads, 'serve')
     while 1:
         chunk = f.read(4096)
         if not chunk:
             break
         yield z.compress(chunk)
 
     yield z.flush()
 
 def capabilities(repo, req):
     caps = ['lookup', 'changegroupsubset', 'branchmap']
     if repo.ui.configbool('server', 'uncompressed', untrusted=True):
         caps.append('stream=%d' % repo.changelog.version)
     if changegroupmod.bundlepriority:
         caps.append('unbundle=%s' % ','.join(changegroupmod.bundlepriority))
     rsp = ' '.join(caps)
     req.respond(HTTP_OK, HGTYPE, length=len(rsp))
     yield rsp
 
 def unbundle(repo, req):
 
     proto = req.env.get('wsgi.url_scheme') or 'http'
     their_heads = req.form['heads'][0].split(' ')
 
     def check_heads():
         heads = map(hex, repo.heads())
         return their_heads == [hex('force')] or their_heads == heads
 
     # fail early if possible
     if not check_heads():
         req.drain()
         raise ErrorResponse(HTTP_OK, 'unsynced changes')
 
     # do not lock repo until all changegroup data is
     # streamed. save to temporary file.
 
     fd, tempname = tempfile.mkstemp(prefix='hg-unbundle-')
     fp = os.fdopen(fd, 'wb+')
     try:
         length = int(req.env['CONTENT_LENGTH'])
         for s in util.filechunkiter(req, limit=length):
             fp.write(s)
 
         try:
             lock = repo.lock()
             try:
                 if not check_heads():
                     raise ErrorResponse(HTTP_OK, 'unsynced changes')
 
                 fp.seek(0)
                 header = fp.read(6)
                 if header.startswith('HG') and not header.startswith('HG10'):
                     raise ValueError('unknown bundle version')
                 elif header not in changegroupmod.bundletypes:
                     raise ValueError('unknown bundle compression type')
                 gen = changegroupmod.unbundle(header, fp)
 
                 # send addchangegroup output to client
 
                 oldio = sys.stdout, sys.stderr
                 sys.stderr = sys.stdout = cStringIO.StringIO()
 
                 try:
-                    url = 'remote:%s:%s' % (proto,
-                                            urllib.quote(
-                                              req.env.get('REMOTE_HOST', '')))
+                    url = 'remote:%s:%s:%s' % (
+                          proto,
+                          urllib.quote(req.env.get('REMOTE_HOST', '')),
+                          urllib.quote(req.env.get('REMOTE_USER', '')))
                     try:
                         ret = repo.addchangegroup(gen, 'serve', url)
                     except util.Abort, inst:
                         sys.stdout.write("abort: %s\n" % inst)
                         ret = 0
                 finally:
                     val = sys.stdout.getvalue()
                     sys.stdout, sys.stderr = oldio
                 req.respond(HTTP_OK, HGTYPE)
                 return '%d\n%s' % (ret, val),
             finally:
                 lock.release()
         except ValueError, inst:
             raise ErrorResponse(HTTP_OK, inst)
         except (OSError, IOError), inst:
             filename = getattr(inst, 'filename', '')
             # Don't send our filesystem layout to the client
             if filename.startswith(repo.root):
                 filename = filename[len(repo.root)+1:]
             else:
                 filename = ''
             error = getattr(inst, 'strerror', 'Unknown error')
             if inst.errno == errno.ENOENT:
                 code = HTTP_NOT_FOUND
             else:
                 code = HTTP_SERVER_ERROR
             raise ErrorResponse(code, '%s: %s' % (error, filename))
     finally:
         fp.close()
         os.unlink(tempname)
 
 def stream_out(repo, req):
     req.respond(HTTP_OK, HGTYPE)
     try:
         for chunk in streamclone.stream_out(repo, untrusted=True):
             yield chunk
     except streamclone.StreamException, inst:
         yield str(inst)