DiffusionServeController.php
b0bf1c689a9dmaster

DiffusionServeController.php
View Options

			<?php

			final class DiffusionServeController extends DiffusionController {

			private $serviceViewer;
			private $serviceRepository;

			private $isGitLFSRequest;
			private $gitLFSToken;
			private $gitLFSInput;

			public function setServiceViewer(PhabricatorUser $viewer) {
			$this->getRequest()->setUser($viewer);

			$this->serviceViewer = $viewer;
			return $this;
			}

			public function getServiceViewer() {
			return $this->serviceViewer;
			}

			public function setServiceRepository(PhabricatorRepository $repository) {
			$this->serviceRepository = $repository;
			return $this;
			}

			public function getServiceRepository() {
			return $this->serviceRepository;
			}

			public function getIsGitLFSRequest() {
			return $this->isGitLFSRequest;
			}

			public function getGitLFSToken() {
			return $this->gitLFSToken;
			}

			public function isVCSRequest(AphrontRequest $request) {
			$identifier = $this->getRepositoryIdentifierFromRequest($request);
			if ($identifier === null) {
			return null;
			}

			$content_type = $request->getHTTPHeader('Content-Type', '');
			$user_agent = idx($_SERVER, 'HTTP_USER_AGENT', '');
			$request_type = $request->getHTTPHeader('X-Phabricator-Request-Type');

			// This may have a "charset" suffix, so only match the prefix.
			$lfs_pattern = '(^application/vnd\\.git-lfs\\+json(;\|\z))';

			$vcs = null;
			if ($request->getExists('service')) {
			$service = $request->getStr('service');
			// We get this initially for `info/refs`.
			// Git also gives us a User-Agent like "git/1.8.2.3".
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
			} else if (strncmp($user_agent, 'git/', 4) === 0) {
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
			} else if ($content_type == 'application/x-git-upload-pack-request') {
			// We get this for `git-upload-pack`.
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
			} else if ($content_type == 'application/x-git-receive-pack-request') {
			// We get this for `git-receive-pack`.
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
			} else if (preg_match($lfs_pattern, $content_type)) {
			// This is a Git LFS HTTP API request.
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
			$this->isGitLFSRequest = true;
			} else if ($request_type == 'git-lfs') {
			// This is a Git LFS object content request.
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
			$this->isGitLFSRequest = true;
			} else if ($request->getExists('cmd')) {
			// Mercurial also sends an Accept header like
			// "application/mercurial-0.1", and a User-Agent like
			// "mercurial/proto-1.0".
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL;
			} else {
			// Subversion also sends an initial OPTIONS request (vs GET/POST), and
			// has a User-Agent like "SVN/1.8.3 (x86_64-apple-darwin11.4.2)
			// serf/1.3.2".
			$dav = $request->getHTTPHeader('DAV');
			$dav = new PhutilURI($dav);
			if ($dav->getDomain() === 'subversion.tigris.org') {
			$vcs = PhabricatorRepositoryType::REPOSITORY_TYPE_SVN;
			}
			}

			return $vcs;
			}

			public function handleRequest(AphrontRequest $request) {
			$service_exception = null;
			$response = null;

			try {
			$response = $this->serveRequest($request);
			} catch (Exception $ex) {
			$service_exception = $ex;
			}

			try {
			$remote_addr = $request->getRemoteAddress();

			if ($request->isHTTPS()) {
			$remote_protocol = PhabricatorRepositoryPullEvent::PROTOCOL_HTTPS;
			} else {
			$remote_protocol = PhabricatorRepositoryPullEvent::PROTOCOL_HTTP;
			}

			$pull_event = id(new PhabricatorRepositoryPullEvent())
			->setEpoch(PhabricatorTime::getNow())
			->setRemoteAddress($remote_addr)
			->setRemoteProtocol($remote_protocol);

			if ($response) {
			$response_code = $response->getHTTPResponseCode();

			if ($response_code == 200) {
			$pull_event
			->setResultType(PhabricatorRepositoryPullEvent::RESULT_PULL)
			->setResultCode($response_code);
			} else {
			$pull_event
			->setResultType(PhabricatorRepositoryPullEvent::RESULT_ERROR)
			->setResultCode($response_code);
			}

			if ($response instanceof PhabricatorVCSResponse) {
			$pull_event->setProperties(
			array(
			'response.message' => $response->getMessage(),
			));
			}
			} else {
			$pull_event
			->setResultType(PhabricatorRepositoryPullEvent::RESULT_EXCEPTION)
			->setResultCode(500)
			->setProperties(
			array(
			'exception.class' => get_class($ex),
			'exception.message' => $ex->getMessage(),
			));
			}

			$viewer = $this->getServiceViewer();
			if ($viewer) {
			$pull_event->setPullerPHID($viewer->getPHID());
			}

			$repository = $this->getServiceRepository();
			if ($repository) {
			$pull_event->setRepositoryPHID($repository->getPHID());
			}

			$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
			$pull_event->save();
			unset($unguarded);

			} catch (Exception $ex) {
			if ($service_exception) {
			throw $service_exception;
			}
			throw $ex;
			}

			if ($service_exception) {
			throw $service_exception;
			}

			return $response;
			}

			private function serveRequest(AphrontRequest $request) {
			$identifier = $this->getRepositoryIdentifierFromRequest($request);

			// If authentication credentials have been provided, try to find a user
			// that actually matches those credentials.

			// We require both the username and password to be nonempty, because Git
			// won't prompt users who provide a username but no password otherwise.
			// See T10797 for discussion.

			$have_user = strlen(idx($_SERVER, 'PHP_AUTH_USER', ''));
			$have_pass = strlen(idx($_SERVER, 'PHP_AUTH_PW', ''));
			if ($have_user && $have_pass) {
			$username = $_SERVER['PHP_AUTH_USER'];
			$password = new PhutilOpaqueEnvelope($_SERVER['PHP_AUTH_PW']);

			// Try Git LFS auth first since we can usually reject it without doing
			// any queries, since the username won't match the one we expect or the
			// request won't be LFS.
			$viewer = $this->authenticateGitLFSUser(
			$username,
			$password,
			$identifier);

			// If that failed, try normal auth. Note that we can use normal auth on
			// LFS requests, so this isn't strictly an alternative to LFS auth.
			if (!$viewer) {
			$viewer = $this->authenticateHTTPRepositoryUser($username, $password);
			}

			if (!$viewer) {
			return new PhabricatorVCSResponse(
			403,
			pht('Invalid credentials.'));
			}
			} else {
			// User hasn't provided credentials, which means we count them as
			// being "not logged in".
			$viewer = new PhabricatorUser();
			}

			// See T13590. Some pathways, like error handling, may require unusual
			// access to things like timezone information. These are fine to build
			// inline; this pathway is not lightweight anyway.
			$viewer->setAllowInlineCacheGeneration(true);

			$this->setServiceViewer($viewer);

			$allow_public = PhabricatorEnv::getEnvConfig('policy.allow-public');
			$allow_auth = PhabricatorEnv::getEnvConfig('diffusion.allow-http-auth');
			if (!$allow_public) {
			if (!$viewer->isLoggedIn()) {
			if ($allow_auth) {
			return new PhabricatorVCSResponse(
			401,
			pht('You must log in to access repositories.'));
			} else {
			return new PhabricatorVCSResponse(
			403,
			pht('Public and authenticated HTTP access are both forbidden.'));
			}
			}
			}

			try {
			$repository = id(new PhabricatorRepositoryQuery())
			->setViewer($viewer)
			->withIdentifiers(array($identifier))
			->needURIs(true)
			->executeOne();
			if (!$repository) {
			return new PhabricatorVCSResponse(
			404,
			pht('No such repository exists.'));
			}
			} catch (PhabricatorPolicyException $ex) {
			if ($viewer->isLoggedIn()) {
			return new PhabricatorVCSResponse(
			403,
			pht('You do not have permission to access this repository.'));
			} else {
			if ($allow_auth) {
			return new PhabricatorVCSResponse(
			401,
			pht('You must log in to access this repository.'));
			} else {
			return new PhabricatorVCSResponse(
			403,
			pht(
			'This repository requires authentication, which is forbidden '.
			'over HTTP.'));
			}
			}
			}

			$response = $this->validateGitLFSRequest($repository, $viewer);
			if ($response) {
			return $response;
			}

			$this->setServiceRepository($repository);

			if (!$repository->isTracked()) {
			return new PhabricatorVCSResponse(
			403,
			pht('This repository is inactive.'));
			}

			$is_push = !$this->isReadOnlyRequest($repository);

			if ($this->getIsGitLFSRequest() && $this->getGitLFSToken()) {
			// We allow git LFS requests over HTTP even if the repository does not
			// otherwise support HTTP reads or writes, as long as the user is using a
			// token from SSH. If they're using HTTP username + password auth, they
			// have to obey the normal HTTP rules.
			} else {
			// For now, we don't distinguish between HTTP and HTTPS-originated
			// requests that are proxied within the cluster, so the user can connect
			// with HTTPS but we may be on HTTP by the time we reach this part of
			// the code. Allow things to move forward as long as either protocol
			// can be served.
			$proto_https = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_HTTPS;
			$proto_http = PhabricatorRepositoryURI::BUILTIN_PROTOCOL_HTTP;

			$can_read =
			$repository->canServeProtocol($proto_https, false) \|\|
			$repository->canServeProtocol($proto_http, false);
			if (!$can_read) {
			return new PhabricatorVCSResponse(
			403,
			pht('This repository is not available over HTTP.'));
			}

			if ($is_push) {
			if ($repository->isReadOnly()) {
			return new PhabricatorVCSResponse(
			503,
			$repository->getReadOnlyMessageForDisplay());
			}

			$can_write =
			$repository->canServeProtocol($proto_https, true) \|\|
			$repository->canServeProtocol($proto_http, true);
			if (!$can_write) {
			return new PhabricatorVCSResponse(
			403,
			pht('This repository is read-only over HTTP.'));
			}
			}
			}

			if ($is_push) {
			$can_push = PhabricatorPolicyFilter::hasCapability(
			$viewer,
			$repository,
			DiffusionPushCapability::CAPABILITY);
			if (!$can_push) {
			if ($viewer->isLoggedIn()) {
			$error_code = 403;
			$error_message = pht(
			'You do not have permission to push to this repository ("%s").',
			$repository->getDisplayName());

			if ($this->getIsGitLFSRequest()) {
			return DiffusionGitLFSResponse::newErrorResponse(
			$error_code,
			$error_message);
			} else {
			return new PhabricatorVCSResponse(
			$error_code,
			$error_message);
			}
			} else {
			if ($allow_auth) {
			return new PhabricatorVCSResponse(
			401,
			pht('You must log in to push to this repository.'));
			} else {
			return new PhabricatorVCSResponse(
			403,
			pht(
			'Pushing to this repository requires authentication, '.
			'which is forbidden over HTTP.'));
			}
			}
			}
			}

			$vcs_type = $repository->getVersionControlSystem();
			$req_type = $this->isVCSRequest($request);

			if ($vcs_type != $req_type) {
			switch ($req_type) {
			case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
			$result = new PhabricatorVCSResponse(
			500,
			pht(
			'This repository ("%s") is not a Git repository.',
			$repository->getDisplayName()));
			break;
			case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
			$result = new PhabricatorVCSResponse(
			500,
			pht(
			'This repository ("%s") is not a Mercurial repository.',
			$repository->getDisplayName()));
			break;
			case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
			$result = new PhabricatorVCSResponse(
			500,
			pht(
			'This repository ("%s") is not a Subversion repository.',
			$repository->getDisplayName()));
			break;
			default:
			$result = new PhabricatorVCSResponse(
			500,
			pht('Unknown request type.'));
			break;
			}
			} else {
			switch ($vcs_type) {
			case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
			case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
			$caught = null;
			try {
			$result = $this->serveVCSRequest($repository, $viewer);
			} catch (Exception $ex) {
			$caught = $ex;
			} catch (Throwable $ex) {
			$caught = $ex;
			}

			if ($caught) {
			// We never expect an uncaught exception here, so dump it to the
			// log. All routine errors should have been converted into Response
			// objects by a lower layer.
			phlog($caught);

			$result = new PhabricatorVCSResponse(
			500,
			phutil_string_cast($caught->getMessage()));
			}
			break;
			case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
			$result = new PhabricatorVCSResponse(
			500,
			pht(
			'This server does not support HTTP access to Subversion '.
			'repositories.'));
			break;
			default:
			$result = new PhabricatorVCSResponse(
			500,
			pht('Unknown version control system.'));
			break;
			}
			}

			$code = $result->getHTTPResponseCode();

			if ($is_push && ($code == 200)) {
			$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
			$repository->writeStatusMessage(
			PhabricatorRepositoryStatusMessage::TYPE_NEEDS_UPDATE,
			PhabricatorRepositoryStatusMessage::CODE_OKAY);
			unset($unguarded);
			}

			return $result;
			}

			private function serveVCSRequest(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer) {

			// We can serve Git LFS requests first, since we don't need to proxy them.
			// It's also important that LFS requests never fall through to standard
			// service pathways, because that would let you use LFS tokens to read
			// normal repository data.
			if ($this->getIsGitLFSRequest()) {
			return $this->serveGitLFSRequest($repository, $viewer);
			}

			// If this repository is hosted on a service, we need to proxy the request
			// to a host which can serve it.
			$is_cluster_request = $this->getRequest()->isProxiedClusterRequest();

			$uri = $repository->getAlmanacServiceURI(
			$viewer,
			array(
			'neverProxy' => $is_cluster_request,
			'protocols' => array(
			'http',
			'https',
			),
			'writable' => !$this->isReadOnlyRequest($repository),
			));
			if ($uri) {
			$future = $this->getRequest()->newClusterProxyFuture($uri);
			return id(new AphrontHTTPProxyResponse())
			->setHTTPFuture($future);
			}

			// Otherwise, we're going to handle the request locally.

			$vcs_type = $repository->getVersionControlSystem();
			switch ($vcs_type) {
			case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
			$result = $this->serveGitRequest($repository, $viewer);
			break;
			case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
			$result = $this->serveMercurialRequest($repository, $viewer);
			break;
			}

			return $result;
			}

			/**
			* @return bool
			*/
			private function isReadOnlyRequest(
			PhabricatorRepository $repository) {
			$request = $this->getRequest();
			$method = $_SERVER['REQUEST_METHOD'];

			// TODO: This implementation is safe by default, but very incomplete.

			if ($this->getIsGitLFSRequest()) {
			return $this->isGitLFSReadOnlyRequest($repository);
			}

			switch ($repository->getVersionControlSystem()) {
			case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
			$service = $request->getStr('service');
			$path = $this->getRequestDirectoryPath($repository);
			// NOTE: Service names are the reverse of what you might expect, as they
			// are from the point of view of the server. The main read service is
			// "git-upload-pack", and the main write service is "git-receive-pack".

			if ($method == 'GET' &&
			$path == '/info/refs' &&
			$service == 'git-upload-pack') {
			return true;
			}

			if ($path == '/git-upload-pack') {
			return true;
			}

			break;
			case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
			$cmd = $request->getStr('cmd');
			if ($cmd == 'batch') {
			$cmds = idx($this->getMercurialArguments(), 'cmds');
			return DiffusionMercurialWireProtocol::isReadOnlyBatchCommand($cmds);
			}
			return DiffusionMercurialWireProtocol::isReadOnlyCommand($cmd);
			case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
			break;
			}

			return false;
			}

			/**
			* @phutil-external-symbol class PhabricatorStartup
			*/
			private function serveGitRequest(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer) {
			$request = $this->getRequest();

			$request_path = $this->getRequestDirectoryPath($repository);
			$repository_root = $repository->getLocalPath();

			// Rebuild the query string to strip `__magic__` parameters and prevent
			// issues where we might interpret inputs like "service=read&service=write"
			// differently than the server does and pass it an unsafe command.

			// NOTE: This does not use getPassthroughRequestParameters() because
			// that code is HTTP-method agnostic and will encode POST data.

			$query_data = $_GET;
			foreach ($query_data as $key => $value) {
			if (!strncmp($key, '__', 2)) {
			unset($query_data[$key]);
			}
			}
			$query_string = phutil_build_http_querystring($query_data);

			// We're about to wipe out PATH with the rest of the environment, so
			// resolve the binary first.
			$bin = Filesystem::resolveBinary('git-http-backend');
			if (!$bin) {
			throw new Exception(
			pht(
			'Unable to find `%s` in %s!',
			'git-http-backend',
			'$PATH'));
			}

			// NOTE: We do not set HTTP_CONTENT_ENCODING here, because we already
			// decompressed the request when we read the request body, so the body is
			// just plain data with no encoding.

			$env = array(
			'REQUEST_METHOD' => $_SERVER['REQUEST_METHOD'],
			'QUERY_STRING' => $query_string,
			'CONTENT_TYPE' => $request->getHTTPHeader('Content-Type'),
			'REMOTE_ADDR' => $_SERVER['REMOTE_ADDR'],
			'GIT_PROJECT_ROOT' => $repository_root,
			'GIT_HTTP_EXPORT_ALL' => '1',
			'PATH_INFO' => $request_path,

			'REMOTE_USER' => $viewer->getUsername(),

			// TODO: Set these correctly.
			// GIT_COMMITTER_NAME
			// GIT_COMMITTER_EMAIL
			) + $this->getCommonEnvironment($viewer);

			$input = PhabricatorStartup::getRawInput();

			$command = csprintf('%s', $bin);
			$command = PhabricatorDaemon::sudoCommandAsDaemonUser($command);

			$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

			$cluster_engine = id(new DiffusionRepositoryClusterEngine())
			->setViewer($viewer)
			->setRepository($repository);

			$did_write_lock = false;
			if ($this->isReadOnlyRequest($repository)) {
			$cluster_engine->synchronizeWorkingCopyBeforeRead();
			} else {
			$did_write_lock = true;
			$cluster_engine->synchronizeWorkingCopyBeforeWrite();
			}

			$caught = null;
			try {
			list($err, $stdout, $stderr) = id(new ExecFuture('%C', $command))
			->setEnv($env, true)
			->write($input)
			->resolve();
			} catch (Exception $ex) {
			$caught = $ex;
			}

			if ($did_write_lock) {
			$cluster_engine->synchronizeWorkingCopyAfterWrite();
			}

			unset($unguarded);

			if ($caught) {
			throw $caught;
			}

			if ($err) {
			if ($this->isValidGitShallowCloneResponse($stdout, $stderr)) {
			// Ignore the error if the response passes this special check for
			// validity.
			$err = 0;
			}
			}

			if ($err) {
			return new PhabricatorVCSResponse(
			500,
			pht(
			'Error %d: %s',
			$err,
			phutil_utf8ize($stderr)));
			}

			return id(new DiffusionGitResponse())->setGitData($stdout);
			}

			/**
			* @return string
			*/
			private function getRequestDirectoryPath(PhabricatorRepository $repository) {
			$request = $this->getRequest();
			$request_path = $request->getRequestURI()->getPath();

			$info = PhabricatorRepository::parseRepositoryServicePath(
			$request_path,
			$repository->getVersionControlSystem());
			if ($info) {
			$base_path = $info['path'];
			} else {
			$base_path = '';
			}

			// For Git repositories, strip an optional directory component if it
			// isn't the name of a known Git resource. This allows users to clone
			// repositories as "/diffusion/X/anything.git", for example.
			if ($repository->isGit()) {
			$known = array(
			'info',
			'git-upload-pack',
			'git-receive-pack',
			);

			foreach ($known as $key => $path) {
			$known[$key] = preg_quote($path, '@');
			}

			$known = implode('\|', $known);

			if (preg_match('@^/([^/]+)/('.$known.')(/\|$)@', $base_path)) {
			$base_path = preg_replace('@^/([^/]+)@', '', $base_path);
			}
			}

			return $base_path;
			}

			private function authenticateGitLFSUser(
			$username,
			PhutilOpaqueEnvelope $password,
			$identifier) {

			// Never accept these credentials for requests which aren't LFS requests.
			if (!$this->getIsGitLFSRequest()) {
			return null;
			}

			// If we have the wrong username, don't bother checking if the token
			// is right.
			if ($username !== DiffusionGitLFSTemporaryTokenType::HTTP_USERNAME) {
			return null;
			}

			// See PHI1123. We need to be able to constrain the token query with
			// "withTokenResources(...)" to take advantage of the key on the table.
			// In this case, the repository PHID is the "resource" we're after.

			// In normal workflows, we figure out the viewer first, then use the
			// viewer to load the repository, but that won't work here. Load the
			// repository as the omnipotent viewer, then use the repository PHID to
			// look for a token.

			$omnipotent_viewer = PhabricatorUser::getOmnipotentUser();

			$repository = id(new PhabricatorRepositoryQuery())
			->setViewer($omnipotent_viewer)
			->withIdentifiers(array($identifier))
			->executeOne();
			if (!$repository) {
			return null;
			}

			$lfs_pass = $password->openEnvelope();
			$lfs_hash = PhabricatorHash::weakDigest($lfs_pass);

			$token = id(new PhabricatorAuthTemporaryTokenQuery())
			->setViewer($omnipotent_viewer)
			->withTokenResources(array($repository->getPHID()))
			->withTokenTypes(array(DiffusionGitLFSTemporaryTokenType::TOKENTYPE))
			->withTokenCodes(array($lfs_hash))
			->withExpired(false)
			->executeOne();
			if (!$token) {
			return null;
			}

			$user = id(new PhabricatorPeopleQuery())
			->setViewer($omnipotent_viewer)
			->withPHIDs(array($token->getUserPHID()))
			->executeOne();

			if (!$user) {
			return null;
			}

			if (!$user->isUserActivated()) {
			return null;
			}

			$this->gitLFSToken = $token;

			return $user;
			}

			private function authenticateHTTPRepositoryUser(
			$username,
			PhutilOpaqueEnvelope $password) {

			if (!PhabricatorEnv::getEnvConfig('diffusion.allow-http-auth')) {
			// No HTTP auth permitted.
			return null;
			}

			if (!strlen($username)) {
			// No username.
			return null;
			}

			if (!strlen($password->openEnvelope())) {
			// No password.
			return null;
			}

			$user = id(new PhabricatorPeopleQuery())
			->setViewer(PhabricatorUser::getOmnipotentUser())
			->withUsernames(array($username))
			->executeOne();
			if (!$user) {
			// Username doesn't match anything.
			return null;
			}

			if (!$user->isUserActivated()) {
			// User is not activated.
			return null;
			}

			$request = $this->getRequest();
			$content_source = PhabricatorContentSource::newFromRequest($request);

			$engine = id(new PhabricatorAuthPasswordEngine())
			->setViewer($user)
			->setContentSource($content_source)
			->setPasswordType(PhabricatorAuthPassword::PASSWORD_TYPE_VCS)
			->setObject($user);

			if (!$engine->isValidPassword($password)) {
			return null;
			}

			return $user;
			}

			private function serveMercurialRequest(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer) {
			$request = $this->getRequest();

			$bin = Filesystem::resolveBinary('hg');
			if (!$bin) {
			throw new Exception(
			pht(
			'Unable to find `%s` in %s!',
			'hg',
			'$PATH'));
			}

			$env = $this->getCommonEnvironment($viewer);
			$input = PhabricatorStartup::getRawInput();

			$cmd = $request->getStr('cmd');

			$args = $this->getMercurialArguments();
			$args = $this->formatMercurialArguments($cmd, $args);

			if (strlen($input)) {
			$input = strlen($input)."\n".$input."0\n";
			}

			$command = csprintf(
			'%s -R %s serve --stdio',
			$bin,
			$repository->getLocalPath());
			$command = PhabricatorDaemon::sudoCommandAsDaemonUser($command);

			list($err, $stdout, $stderr) = id(new ExecFuture('%C', $command))
			->setEnv($env, true)
			->setCWD($repository->getLocalPath())
			->write("{$cmd}\n{$args}{$input}")
			->resolve();

			if ($err) {
			return new PhabricatorVCSResponse(
			500,
			pht('Error %d: %s', $err, $stderr));
			}

			if ($cmd == 'getbundle' \|\|
			$cmd == 'changegroup' \|\|
			$cmd == 'changegroupsubset') {
			// We're not completely sure that "changegroup" and "changegroupsubset"
			// actually work, they're for very old Mercurial.
			$body = gzcompress($stdout);
			} else if ($cmd == 'unbundle') {
			// This includes diagnostic information and anything echoed by commit
			// hooks. We ignore `stdout` since it just has protocol garbage, and
			// substitute `stderr`.
			$body = strlen($stderr)."\n".$stderr;
			} else {
			list($length, $body) = explode("\n", $stdout, 2);
			if ($cmd == 'capabilities') {
			$body = DiffusionMercurialWireProtocol::filterBundle2Capability($body);
			}
			}

			return id(new DiffusionMercurialResponse())->setContent($body);
			}

			private function getMercurialArguments() {
			// Mercurial sends arguments in HTTP headers. "Why?", you might wonder,
			// "Why would you do this?".

			$args_raw = array();
			for ($ii = 1;; $ii++) {
			$header = 'HTTP_X_HGARG_'.$ii;
			if (!array_key_exists($header, $_SERVER)) {
			break;
			}
			$args_raw[] = $_SERVER[$header];
			}

			if ($args_raw) {
			$args_raw = implode('', $args_raw);
			return id(new PhutilQueryStringParser())
			->parseQueryString($args_raw);
			}

			// Sometimes arguments come in via the query string. Note that this will
			// not handle multi-value entries e.g. "a[]=1,a[]=2" however it's unclear
			// whether or how the mercurial protocol should handle this.
			$query = idx($_SERVER, 'QUERY_STRING', '');
			$query_pairs = id(new PhutilQueryStringParser())
			->parseQueryString($query);
			foreach ($query_pairs as $key => $value) {
			// Filter out private/internal keys as well as the command itself.
			if (strncmp($key, '__', 2) && $key != 'cmd') {
			$args_raw[$key] = $value;
			}
			}

			// TODO: Arguments can also come in via request body for POST requests. The
			// body would be all arguments, url-encoded.
			return $args_raw;
			}

			private function formatMercurialArguments($command, array $arguments) {
			$spec = DiffusionMercurialWireProtocol::getCommandArgs($command);

			$out = array();

			// Mercurial takes normal arguments like this:
			//
			// name <length(value)>
			// value

			$has_star = false;
			foreach ($spec as $arg_key) {
			if ($arg_key == '*') {
			$has_star = true;
			continue;
			}
			if (isset($arguments[$arg_key])) {
			$value = $arguments[$arg_key];
			$size = strlen($value);
			$out[] = "{$arg_key} {$size}\n{$value}";
			unset($arguments[$arg_key]);
			}
			}

			if ($has_star) {

			// Mercurial takes arguments for variable argument lists roughly like
			// this:
			//
			// * <count(args)>
			// argname1 <length(argvalue1)>
			// argvalue1
			// argname2 <length(argvalue2)>
			// argvalue2

			$count = count($arguments);

			$out[] = "* {$count}\n";

			foreach ($arguments as $key => $value) {
			if (in_array($key, $spec)) {
			// We already added this argument above, so skip it.
			continue;
			}
			$size = strlen($value);
			$out[] = "{$key} {$size}\n{$value}";
			}
			}

			return implode('', $out);
			}

			private function isValidGitShallowCloneResponse($stdout, $stderr) {
			// If you execute `git clone --depth N ...`, git sends a request which
			// `git-http-backend` responds to by emitting valid output and then exiting
			// with a failure code and an error message. If we ignore this error,
			// everything works.

			// This is a pretty funky fix: it would be nice to more precisely detect
			// that a request is a `--depth N` clone request, but we don't have any code
			// to decode protocol frames yet. Instead, look for reasonable evidence
			// in the output that we're looking at a `--depth` clone.

			// A valid x-git-upload-pack-result response during packfile negotiation
			// should end with a flush packet ("0000"). As long as that packet
			// terminates the response body in the response, we'll assume the response
			// is correct and complete.

			// See https://git-scm.com/docs/pack-protocol#_packfile_negotiation

			$stdout_regexp = '(^Content-Type: application/x-git-upload-pack-result)m';

			$has_pack = preg_match($stdout_regexp, $stdout);

			if (strlen($stdout) >= 4) {
			$has_flush_packet = (substr($stdout, -4) === "0000");
			} else {
			$has_flush_packet = false;
			}

			return ($has_pack && $has_flush_packet);
			}

			private function getCommonEnvironment(PhabricatorUser $viewer) {
			$remote_address = $this->getRequest()->getRemoteAddress();

			return array(
			DiffusionCommitHookEngine::ENV_USER => $viewer->getUsername(),
			DiffusionCommitHookEngine::ENV_REMOTE_ADDRESS => $remote_address,
			DiffusionCommitHookEngine::ENV_REMOTE_PROTOCOL => 'http',
			);
			}

			private function validateGitLFSRequest(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer) {
			if (!$this->getIsGitLFSRequest()) {
			return null;
			}

			if (!$repository->canUseGitLFS()) {
			return new PhabricatorVCSResponse(
			403,
			pht(
			'The requested repository ("%s") does not support Git LFS.',
			$repository->getDisplayName()));
			}

			// If this is using an LFS token, sanity check that we're using it on the
			// correct repository. This shouldn't really matter since the user could
			// just request a proper token anyway, but it suspicious and should not
			// be permitted.

			$token = $this->getGitLFSToken();
			if ($token) {
			$resource = $token->getTokenResource();
			if ($resource !== $repository->getPHID()) {
			return new PhabricatorVCSResponse(
			403,
			pht(
			'The authentication token provided in the request is bound to '.
			'a different repository than the requested repository ("%s").',
			$repository->getDisplayName()));
			}
			}

			return null;
			}

			private function serveGitLFSRequest(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer) {

			if (!$this->getIsGitLFSRequest()) {
			throw new Exception(pht('This is not a Git LFS request!'));
			}

			$path = $this->getGitLFSRequestPath($repository);
			$matches = null;

			if (preg_match('(^upload/(.*)\z)', $path, $matches)) {
			$oid = $matches[1];
			return $this->serveGitLFSUploadRequest($repository, $viewer, $oid);
			} else if ($path == 'objects/batch') {
			return $this->serveGitLFSBatchRequest($repository, $viewer);
			} else {
			return DiffusionGitLFSResponse::newErrorResponse(
			404,
			pht(
			'Git LFS operation "%s" is not supported by this server.',
			$path));
			}
			}

			private function serveGitLFSBatchRequest(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer) {

			$input = $this->getGitLFSInput();

			$operation = idx($input, 'operation');
			switch ($operation) {
			case 'upload':
			$want_upload = true;
			break;
			case 'download':
			$want_upload = false;
			break;
			default:
			return DiffusionGitLFSResponse::newErrorResponse(
			404,
			pht(
			'Git LFS batch operation "%s" is not supported by this server.',
			$operation));
			}

			$objects = idx($input, 'objects', array());

			$hashes = array();
			foreach ($objects as $object) {
			$hashes[] = idx($object, 'oid');
			}

			if ($hashes) {
			$refs = id(new PhabricatorRepositoryGitLFSRefQuery())
			->setViewer($viewer)
			->withRepositoryPHIDs(array($repository->getPHID()))
			->withObjectHashes($hashes)
			->execute();
			$refs = mpull($refs, null, 'getObjectHash');
			} else {
			$refs = array();
			}

			$file_phids = mpull($refs, 'getFilePHID');
			if ($file_phids) {
			$files = id(new PhabricatorFileQuery())
			->setViewer($viewer)
			->withPHIDs($file_phids)
			->execute();
			$files = mpull($files, null, 'getPHID');
			} else {
			$files = array();
			}

			$authorization = null;
			$output = array();
			foreach ($objects as $object) {
			$oid = idx($object, 'oid');
			$size = idx($object, 'size');
			$ref = idx($refs, $oid);
			$error = null;

			// NOTE: If we already have a ref for this object, we only emit a
			// "download" action. The client should not upload the file again.

			$actions = array();
			if ($ref) {
			$file = idx($files, $ref->getFilePHID());
			if ($file) {
			// Git LFS may prompt users for authentication if the action does
			// not provide an "Authorization" header and does not have a query
			// parameter named "token". See here for discussion:
			// <https://github.com/github/git-lfs/issues/1088>
			$no_authorization = 'Basic '.base64_encode('none');

			$get_uri = $file->getCDNURI('data');
			$actions['download'] = array(
			'href' => $get_uri,
			'header' => array(
			'Authorization' => $no_authorization,
			'X-Phabricator-Request-Type' => 'git-lfs',
			),
			);
			} else {
			$error = array(
			'code' => 404,
			'message' => pht(
			'Object "%s" was previously uploaded, but no longer exists '.
			'on this server.',
			$oid),
			);
			}
			} else if ($want_upload) {
			if (!$authorization) {
			// Here, we could reuse the existing authorization if we have one,
			// but it's a little simpler to just generate a new one
			// unconditionally.
			$authorization = $this->newGitLFSHTTPAuthorization(
			$repository,
			$viewer,
			$operation);
			}

			$put_uri = $repository->getGitLFSURI("info/lfs/upload/{$oid}");

			$actions['upload'] = array(
			'href' => $put_uri,
			'header' => array(
			'Authorization' => $authorization,
			'X-Phabricator-Request-Type' => 'git-lfs',
			),
			);
			}

			$object = array(
			'oid' => $oid,
			'size' => $size,
			);

			if ($actions) {
			$object['actions'] = $actions;
			}

			if ($error) {
			$object['error'] = $error;
			}

			$output[] = $object;
			}

			$output = array(
			'objects' => $output,
			);

			return id(new DiffusionGitLFSResponse())
			->setContent($output);
			}

			private function serveGitLFSUploadRequest(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer,
			$oid) {

			$ref = id(new PhabricatorRepositoryGitLFSRefQuery())
			->setViewer($viewer)
			->withRepositoryPHIDs(array($repository->getPHID()))
			->withObjectHashes(array($oid))
			->executeOne();
			if ($ref) {
			return DiffusionGitLFSResponse::newErrorResponse(
			405,
			pht(
			'Content for object "%s" is already known to this server. It can '.
			'not be uploaded again.',
			$oid));
			}

			// Remove the execution time limit because uploading large files may take
			// a while.
			set_time_limit(0);

			$request_stream = new AphrontRequestStream();
			$request_iterator = $request_stream->getIterator();
			$hashing_iterator = id(new PhutilHashingIterator($request_iterator))
			->setAlgorithm('sha256');

			$source = id(new PhabricatorIteratorFileUploadSource())
			->setName('lfs-'.$oid)
			->setViewPolicy(PhabricatorPolicies::POLICY_NOONE)
			->setIterator($hashing_iterator);

			$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
			$file = $source->uploadFile();
			unset($unguarded);

			$hash = $hashing_iterator->getHash();
			if ($hash !== $oid) {
			return DiffusionGitLFSResponse::newErrorResponse(
			400,
			pht(
			'Uploaded data is corrupt or invalid. Expected hash "%s", actual '.
			'hash "%s".',
			$oid,
			$hash));
			}

			$ref = id(new PhabricatorRepositoryGitLFSRef())
			->setRepositoryPHID($repository->getPHID())
			->setObjectHash($hash)
			->setByteSize($file->getByteSize())
			->setAuthorPHID($viewer->getPHID())
			->setFilePHID($file->getPHID());

			$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
			// Attach the file to the repository to give users permission
			// to access it.
			$file->attachToObject($repository->getPHID());
			$ref->save();
			unset($unguarded);

			// This is just a plain HTTP 200 with no content, which is what `git lfs`
			// expects.
			return new DiffusionGitLFSResponse();
			}

			private function newGitLFSHTTPAuthorization(
			PhabricatorRepository $repository,
			PhabricatorUser $viewer,
			$operation) {

			$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

			$authorization = DiffusionGitLFSTemporaryTokenType::newHTTPAuthorization(
			$repository,
			$viewer,
			$operation);

			unset($unguarded);

			return $authorization;
			}

			private function getGitLFSRequestPath(PhabricatorRepository $repository) {
			$request_path = $this->getRequestDirectoryPath($repository);

			$matches = null;
			if (preg_match('(^/info/lfs(?:\z\|/)(.*))', $request_path, $matches)) {
			return $matches[1];
			}

			return null;
			}

			private function getGitLFSInput() {
			if (!$this->gitLFSInput) {
			$input = PhabricatorStartup::getRawInput();
			$input = phutil_json_decode($input);
			$this->gitLFSInput = $input;
			}

			return $this->gitLFSInput;
			}

			private function isGitLFSReadOnlyRequest(PhabricatorRepository $repository) {
			if (!$this->getIsGitLFSRequest()) {
			return false;
			}

			$path = $this->getGitLFSRequestPath($repository);

			if ($path === 'objects/batch') {
			$input = $this->getGitLFSInput();
			$operation = idx($input, 'operation');
			switch ($operation) {
			case 'download':
			return true;
			default:
			return false;
			}
			}

			return false;
			}


			}

Owner Packages

No Owners

phorge/src/applications/diffusion/controller/DiffusionServeController.phpb0bf1c689a9dmaster

DiffusionServeController.phpView Options

Owner Packages

phorge/src/applications/diffusion/controller/DiffusionServeController.php
b0bf1c689a9dmaster

DiffusionServeController.php
View Options