From a1f3497ec46881753fc13d25c3cd2cb344ae27d8 Mon Sep 17 00:00:00 2001 From: Nicolas Chuche Date: Sun, 18 Nov 2007 18:51:48 +0000 Subject: [PATCH] * add Redmine.pm to authenticate with mod_perl * add a --test option in reposman.rb * change owner right to fit with apache write access to repositories * add a deprecated warning in reposman.pl git-svn-id: http://redmine.rubyforge.org/svn/trunk@916 e93f8b46-1217-0410-a6f0-8f06a7374b81 --- extra/svn/Redmine.pm | 210 ++++++++++++++++++++++++++++++++++++++++++ extra/svn/reposman.pl | 5 + extra/svn/reposman.rb | 24 ++++- 3 files changed, 237 insertions(+), 2 deletions(-) create mode 100644 extra/svn/Redmine.pm diff --git a/extra/svn/Redmine.pm b/extra/svn/Redmine.pm new file mode 100644 index 000000000..7505b71cb --- /dev/null +++ b/extra/svn/Redmine.pm @@ -0,0 +1,210 @@ +package Apache::Authn::Redmine; + +=head1 Apache::Authn::Redmine + +Redmine - a mod_perl module to authenticate webdav subversion users +against redmine database + +=head1 SYNOPSIS + +This module allow anonymous users to browse public project and +registred users to browse and commit their project. authentication is +done on the redmine database. + +This method is far simpler than the one with pam_* and works with all +database without an hassle but you need to have apache/mod_perl on the +svn server. + +=head1 INSTALLATION + +For this to automagically work, you need to have a recent reposman.rb +(after r860) and if you already use reposman, read the last section to +migrate. + +Sorry ruby users but you need some perl modules, at least mod_perl2, +DBI and DBD::mysql (or the DBD driver for you database as it should +work on allmost all databases). + +On debian/ubuntu you must do : + + aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl + +=head1 CONFIGURATION + + ## if the module isn't in your perl path + PerlRequire /usr/local/apache/Redmine.pm + ## else + # PerlModule Apache::Authn::Redmine + + DAV svn + SVNParentPath "/var/svn" + + AuthType Basic + AuthName redmine + Require valid-user + + PerlAccessHandler Apache::Authn::Redmine::access_handler + PerlAuthenHandler Apache::Authn::Redmine::authen_handler + + ## for mysql + PerlSetVar dsn DBI:mysql:database=databasename;host=my.db.server + ## for postgres + # PerlSetVar dsn DBI:Pg:dbname=databasename;host=my.db.server + + PerlSetVar db_user redmine + PerlSetVar db_pass password + + +To be able to browse repository inside redmine, you must add something +like that : + + + DAV svn + SVNParentPath "/var/svn" + Order deny,allow + Deny from all + # only allow reading orders + + Allow from redmine.server.ip + + + +and you will have to use this reposman.rb command line to create repository : + + reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/ + +=head1 MIGRATION FROM OLDER RELEASES + +If you use an older reposman.rb (r860 or before), you need to change +rights on repositories to allow the apache user to read and write +S + + sudo chown -R www-data /var/svn/* + sudo chmod -R u+w /var/svn/* + +And you need to upgrade at least reposman.rb (after r860). + +=cut + +use strict; + +use DBI; +use Digest::SHA1; + +use Apache2::Module; +use Apache2::Access; +use Apache2::ServerRec qw(); +use Apache2::RequestRec qw(); +use Apache2::RequestUtil qw(); +use Apache2::Const qw(:common); +# use Apache2::Directive qw(); + +my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/; + +sub access_handler { + my $r = shift; + + unless ($r->some_auth_required) { + $r->log_reason("No authentication has been configured"); + return FORBIDDEN; + } + + my $method = $r->method; + return OK unless 1 == $read_only_methods{$method}; + + my $project_id = get_project_identifier($r); + + $r->set_handlers(PerlAuthenHandler => [\&OK]) + if is_public_project($project_id, $r); + + return OK +} + +sub authen_handler { + my $r = shift; + + my ($res, $redmine_pass) = $r->get_basic_auth_pw(); + return $res unless $res == OK; + + if (is_member($r->user, $redmine_pass, $r)) { + return OK; + } else { + $r->note_auth_failure(); + return AUTH_REQUIRED; + } +} + +sub is_public_project { + my $project_id = shift; + my $r = shift; + + my $dbh = connect_database($r); + my $sth = $dbh->prepare( + "SELECT * FROM projects WHERE projects.identifier=? and projects.is_public=true;" + ); + + $sth->execute($project_id); + my $ret = $sth->fetchrow_array ? 1 : 0; + $dbh->disconnect(); + + $ret; +} + +# perhaps we should use repository right (other read right) to check public access. +# it could be faster BUT it doesn't work for the moment. +# sub is_public_project_by_file { +# my $project_id = shift; +# my $r = shift; + +# my $tree = Apache2::Directive::conftree(); +# my $node = $tree->lookup('Location', $r->location); +# my $hash = $node->as_hash; + +# my $svnparentpath = $hash->{SVNParentPath}; +# my $repos_path = $svnparentpath . "/" . $project_id; +# return 1 if (stat($repos_path))[2] & 00007; +# } + +sub is_member { + my $redmine_user = shift; + my $redmine_pass = shift; + my $r = shift; + + my $dbh = connect_database($r); + my $project_id = get_project_identifier($r); + + my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass); + + my $sth = $dbh->prepare( + "SELECT hashed_password FROM members, projects, users WHERE projects.id=members.project_id AND users.id=members.user_id AND login=? AND identifier=?;" + ); + $sth->execute($redmine_user, $project_id); + + my $ret; + while (my @row = $sth->fetchrow_array) { + if ($row[0] eq $pass_digest) { + $ret = 1; + last; + } + } + $dbh->disconnect(); + + $ret; +} + +sub get_project_identifier { + my $r = shift; + + my $location = $r->location; + my ($identifier) = $r->uri =~ m{$location/*([^/]+)}; + $identifier; +} + +sub connect_database { + my $r = shift; + + my ($dsn, $db_user, $db_pass) = map { $r->dir_config($_) } qw/dsn db_user db_pass/; + return DBI->connect($dsn, $db_user, $db_pass); +} + +1; diff --git a/extra/svn/reposman.pl b/extra/svn/reposman.pl index bee800b8b..b8ce8f8af 100755 --- a/extra/svn/reposman.pl +++ b/extra/svn/reposman.pl @@ -23,6 +23,11 @@ use vars qw/$VERSION/; $VERSION = "1.0"; +my $warning = "This program is now deprecated. Use the reposman.rb for new features"; +print STDERR "*" x length($warning), "\n", + $warning, "\n", + "*" x length($warning), "\n\n"; + my %opts = (verbose => 0); GetOptions(\%opts, 'verbose|v+', 'version|V', 'help|h', 'man|m', 'quiet|q', 'svn-dir|s=s', 'redmine-host|r=s') or pod2usage(2); diff --git a/extra/svn/reposman.rb b/extra/svn/reposman.rb index d950f45e4..729970406 100755 --- a/extra/svn/reposman.rb +++ b/extra/svn/reposman.rb @@ -37,6 +37,8 @@ # -u file:///var/svn/ # if the repository is local # if this option isn't set, reposman won't register the repository # +# -t, --test +# only show what should be done # # -h, --help: # show help and exit @@ -64,6 +66,7 @@ opts = GetoptLong.new( ['--redmine-host', '-r', GetoptLong::REQUIRED_ARGUMENT], ['--owner', '-o', GetoptLong::REQUIRED_ARGUMENT], ['--url', '-u', GetoptLong::REQUIRED_ARGUMENT], + ['--test', '-t', GetoptLong::NO_ARGUMENT], ['--verbose', '-v', GetoptLong::NO_ARGUMENT], ['--version', '-V', GetoptLong::NO_ARGUMENT], ['--help' , '-h', GetoptLong::NO_ARGUMENT], @@ -76,6 +79,7 @@ $redmine_host = '' $repos_base = '' $svn_owner = 'root' $svn_url = false +$test = false def log(text,level=0, exit=false) return if $quiet or level > $verbose @@ -91,6 +95,7 @@ begin when '--owner'; $svn_owner = arg.dup when '--url'; $svn_url = arg.dup when '--verbose'; $verbose += 1 + when '--test'; $test = true when '--version'; puts Version; exit when '--help'; RDoc::usage when '--quiet'; $quiet = true @@ -100,6 +105,10 @@ rescue exit 1 end +if $test + log("running in test mode") +end + $svn_url += "/" if $svn_url and not $svn_url.match(/\/$/) if ($redmine_host.empty? or $repos_base.empty?) @@ -136,7 +145,7 @@ def set_owner_and_rights(project, repos_path, &block) yield if block_given? else uid, gid = Etc.getpwnam($svn_owner).uid, Etc.getgrnam(project.identifier).gid - right = project.is_public ? 0575 : 0570 + right = project.is_public ? 0775 : 0770 yield if block_given? Find.find(repos_path) do |f| File.chmod right, f @@ -176,6 +185,11 @@ projects.each do |project| owner = owner_name(repos_path) next if project.is_public == other_read and owner == $svn_owner + if $test + log("\tchange mode on #{repos_path}") + next + end + begin set_owner_and_rights(project, repos_path) rescue Errno::EPERM => e @@ -186,7 +200,13 @@ projects.each do |project| log("\tmode change on #{repos_path}"); else - project.is_public ? File.umask(0202) : File.umask(0207) + project.is_public ? File.umask(0002) : File.umask(0007) + + if $test + log("\tcreate repository #{repos_path}") + log("\trepository #{repos_path} registered in Redmine with url #{$svn_url}#{project.identifier}") if $svn_url; + next + end begin set_owner_and_rights(project, repos_path) do