Show More
@@ -8,7 +8,8 b'' | |||
|
8 | 8 | '''hooks for controlling repository access |
|
9 | 9 | |
|
10 | 10 | This hook makes it possible to allow or deny write access to portions |
|
11 |
of a repository when receiving incoming changesets |
|
|
11 | of a repository when receiving incoming changesets via pretxnchangegroup and | |
|
12 | pretxncommit. | |
|
12 | 13 | |
|
13 | 14 | The authorization is matched based on the local user name on the |
|
14 | 15 | system where the hook runs, and not the committer of the original |
@@ -21,12 +22,31 b' interactive shell access, as they can th' | |||
|
21 | 22 | Nor is it safe if remote users share an account, because then there |
|
22 | 23 | is no way to distinguish them. |
|
23 | 24 | |
|
24 | To use this hook, configure the acl extension in your hgrc like this:: | |
|
25 | The deny list is checked before the allow list is. | |
|
26 | ||
|
27 | The allow and deny sections take key-value pairs, having a subtree pattern | |
|
28 | as key (with a glob syntax by default). The corresponding value can be either: | |
|
29 | 1) an asterisk, to match everyone; | |
|
30 | 2) a comma-separated list containing users and groups. | |
|
31 | ||
|
32 | Group names must be prefixed with an @ symbol. | |
|
33 | Specifying a group name has the same effect as specifying all the users in | |
|
34 | that group. | |
|
35 | The set of users for a group is taken from "grp.getgrnam" | |
|
36 | (see http://docs.python.org/library/grp.html#grp.getgrnam). | |
|
37 | ||
|
38 | To use this hook, configure the acl extension in your hgrc like this: | |
|
25 | 39 | |
|
26 | 40 | [extensions] |
|
27 | 41 | acl = |
|
28 | 42 | |
|
29 | 43 | [hooks] |
|
44 | ||
|
45 | # Use this if you want to check access restrictions at commit time | |
|
46 | pretxncommit.acl = python:hgext.acl.hook | |
|
47 | ||
|
48 | # Use this if you want to check access restrictions for pull, push, bundle | |
|
49 | # and serve. | |
|
30 | 50 | pretxnchangegroup.acl = python:hgext.acl.hook |
|
31 | 51 | |
|
32 | 52 | [acl] |
@@ -34,22 +54,43 b' To use this hook, configure the acl exte' | |||
|
34 | 54 | # ("serve" == ssh or http, "push", "pull", "bundle") |
|
35 | 55 | sources = serve |
|
36 | 56 | |
|
37 | The allow and deny sections take a subtree pattern as key (with a glob | |
|
38 | syntax by default), and a comma separated list of users as the | |
|
39 | corresponding value. The deny list is checked before the allow list | |
|
40 | is. :: | |
|
57 | [acl.deny] | |
|
58 | # This list is checked first. If a match is found, 'acl.allow' will not be | |
|
59 | # checked. | |
|
60 | # if acl.deny is not present, no users denied by default | |
|
61 | # empty acl.deny = all users allowed | |
|
62 | # Format for both lists: glob pattern = user4, user5, @group1 | |
|
63 | ||
|
64 | # To match everyone, use an asterisk for the user: | |
|
65 | # my/glob/pattern = * | |
|
66 | ||
|
67 | # user6 will not have write access to any file: | |
|
68 | ** = user6 | |
|
69 | ||
|
70 | # Group "hg-denied" will not have write access to any file: | |
|
71 | ** = @hg-denied | |
|
72 | ||
|
73 | # Nobody will be able to change "DONT-TOUCH-THIS.txt", despite everyone being | |
|
74 | # able to change all other files. See below. | |
|
75 | src/main/resources/DONT-TOUCH-THIS.txt = * | |
|
41 | 76 | |
|
42 | 77 | [acl.allow] |
|
43 |
# |
|
|
44 |
# |
|
|
78 | # if acl.allow not present, all users allowed by default | |
|
79 | # empty acl.allow = no users allowed | |
|
80 | ||
|
81 | # User "doc_writer" has write access to any file under the "docs" folder: | |
|
45 | 82 | docs/** = doc_writer |
|
83 | ||
|
84 | # User "jack" and group "designers" have write access to any file under the | |
|
85 | # "images" folder: | |
|
86 | images/** = jack, @designers | |
|
87 | ||
|
88 | # Everyone (except for "user6" - see "acl.deny" above) will have write access | |
|
89 | to any file under the "resources" folder (except for 1 file. See "acl.deny"): | |
|
90 | src/main/resources/** = * | |
|
91 | ||
|
46 | 92 | .hgtags = release_engineer |
|
47 | 93 | |
|
48 | [acl.deny] | |
|
49 | # If acl.deny is not present, no users are refused by default. | |
|
50 | # An empty acl.deny section means all users allowed. | |
|
51 | glob pattern = user4, user5 | |
|
52 | ** = user6 | |
|
53 | 94 | ''' |
|
54 | 95 | |
|
55 | 96 | from mercurial.i18n import _ |
General Comments 0
You need to be logged in to leave comments.
Login now