Subject: Re: [PATCH 1/2] gitweb: allow access to forks with strict_export

From: Jakub Narebski <[email-masked]>
Date: Sat, 20 Dec 2008 01:35:48 +0100

On Sun, 14 Dec 2008 03:06, Matt McCutchen napisał:
> On Sat, 2008-12-13 at 23:51 +0100, Jakub Narebski wrote:
> >
> > "no_hide" (currently "include_forks") allows us to _not_ passing this
> > parameter in other places than project_in_list(); undef is falsy.
> 
> Right.  That's why I made the current parameter $for_strict_export (so
> only project_in_list passes it) rather than the negation.

Still I think $for_strict_export is singularly _bad_ name for
a parameter. $no_hide or $show_all would be much, much better.

> > By the way, doesn't git_project_index and perhaps git_opml also need
> > this parameter passed to git_get_projects_list?
> 
> Yes, now that you mention it, I suppose they should show forks, though
> not hidden repositories.  Then git_get_projects_list can be called in
> three different modes: include everything (project_in_list), include
> forks but not hidden (git_get_project_index and git_opml), or include
> neither forks nor hidden (git_project_list).  Should we have two
> separate parameters to git_get_projects_list or a single three-valued
> one?

By the way, I am not sure if your idea of "hidden projects" and projects
list (projects index) file.

We have two way of specifying list of projects. One is scanning
projectroot directory for something that looks like git repository,
the other is having projects list file with project paths and project
owners.

If you use projects list file, you can have projects which are in not
on project list, but are accessible in filesystem. Those projects
(repositories) are hidden, i.e. they are not visible on projects_list
page, but still you can access a project. If you want to have projects
which are not on list to be not accessible at all, and not only hidden,
you have to use $strict_export... using which makes access to repo
views a tiny bit slower (and _only_ slows down gitweb for when scanning
directories for projects).

But why would one _want_ projects which are not visible, but still
accessible; "hidden" projects? Moreso what you want, the three class
of projects inside $projectroot: visible, hidden, and not exported.

With newly added $export_auth_hook you can limit accessibility of
projects in other ways, for example using .htaccess control files of
Apache web server.  Check gitweb/README (or gitweb/INSTALL) for
example.

> That raises another point.  I was going to change git_get_projects_list
> so that forks of a hidden project that are not themselves hidden appear
> on the parent project's page but not in the main project list.  This
> way, users who know about the parent project can navigate to the fork,
> but the fork does not give away the existence of the parent project by
> appearing in the main list.  Then I guess git_project_index and git_opml
> should omit forks of hidden projects, meaning that some fork-checking
> still has to take place with "include forks" on but "include hidden"
> off.  This will make git_get_projects_list somewhat more complex but not
> unmanageably so, and I do think it's the behavior we want.
> 
> I will send an updated patch.

So you see that having explicitly hidden files have yet another
complication. I wonder if this is really worth it...

-- 
Jakub Narebski
Poland