-
Notifications
You must be signed in to change notification settings - Fork 153
Description
Describe the bug
checkUserPushPermission is intended to check whether the user performing the push is allowed to do so. However, it is currently checking the permission of the committer of the last commit in the push in its current location, rather than the user pushing it into git proxy.
Commits in git are tagged with two users' details: the author (who created the commit and originally pushed it to a repo) and the committer (initially the same as the author, (削除) but changes whenever the commit is pushed to a different repository or branch (削除ここまで) but changes whenever a commit is created or modified (e.g., via git commit, git commit --amend, git rebase, git merge) - git push does NOT change the committer. When we process a push in git proxy, we do so using the original committer of the last commit rather than the user performing the push - which is not the intent of the check.
parsePush is extracting the committer and committerEmail from the last commit in the push and setting them as the user and userEmail in the action object:
git-proxy/src/proxy/processors/push-action/parsePush.ts
Lines 93 to 96 in 6fb63d0
This is not the correct user information and needs to be corrected in parsePush, without using action.commitData.
To Reproduce
- Setup a project in Git proxy where you are allowed to contribute but no other user is
- Have a different user push a commit to a branch of the respository.
- Clone that branch yourself.
- While that different user's commit is the last one on that branch, push the branch to git proxy.
checkUserPushPermissionwill reject the push as it will use the other user's information as the committer,
Expected behavior
parsePush should use the details of the user trying to push through the proxy as the user and userEmail values of the action (rather than the user that original pushed the last commit), ensuring that checkUserPushPermission checks the correct user's details.