[mirror] Scalable static site server for Git forges (like GitHub Pages)

Treat `allowed-repository-url-prefixes = []` the same as unspecified.

Previously, this would disallow all git clones except for those via
wildcard domains. This is highly unintuitive. It also meant that
disabling this function via environment variable was not possible.

Changed files
+4 -4
conf
src
+1 -1
conf/config.example.toml
··· 51 51 update-timeout = "60s" 52 52 max-heap-size-ratio = 0.5 # * RAM_size 53 53 forbidden-domains = [] 54 - # allowed-repository-url-prefixes = <nil> 54 + allowed-repository-url-prefixes = [] 55 55 allowed-custom-headers = ["X-Clacks-Overhead"] 56 56 57 57 [audit]
+2 -2
src/auth.go
··· 436 436 } 437 437 438 438 func checkAllowedURLPrefix(repoURL string) error { 439 - if config.Limits.AllowedRepositoryURLPrefixes != nil { 439 + if len(config.Limits.AllowedRepositoryURLPrefixes) > 0 { 440 440 allowedPrefix := false 441 441 repoURL = strings.ToLower(repoURL) 442 442 for _, allowedRepoURLPrefix := range config.Limits.AllowedRepositoryURLPrefixes { ··· 658 658 return auth, nil 659 659 } 660 660 661 - if config.Limits.AllowedRepositoryURLPrefixes != nil { 661 + if len(config.Limits.AllowedRepositoryURLPrefixes) > 0 { 662 662 causes = append(causes, AuthError{http.StatusUnauthorized, "DNS challenge not allowed"}) 663 663 } else { 664 664 // DNS challenge gives absolute authority.
+1 -1
src/config.go
··· 140 140 // List of domains unconditionally forbidden for uploads. 141 141 ForbiddenDomains []string `toml:"forbidden-domains" default:"[]"` 142 142 // List of allowed repository URL prefixes. Setting this option prohibits uploading archives. 143 - AllowedRepositoryURLPrefixes []string `toml:"allowed-repository-url-prefixes"` 143 + AllowedRepositoryURLPrefixes []string `toml:"allowed-repository-url-prefixes" default:"[]"` 144 144 // List of allowed custom headers. Header name must be in the MIME canonical form, 145 145 // e.g. `Foo-Bar`. Setting this option permits including this custom header in `_headers`, 146 146 // unless it is fundamentally unsafe.