Subject: Re: security flaw with smart http

From: Ivan Kanis <[email-masked]>
Date: Thu, 28 Jun 2012 09:35:23 +0200

Junio C Hamano <[email-masked]> a écrit

> Shawn Pearce <[email-masked]> writes:
>
>> On Fri, Jun 22, 2012 at 3:12 AM, Ivan Kanis <[email-masked]> wrote:
>>> I think we found a security flaw with git http smart backend. We are
>>> running git version 1.0.7.4 on our server. Adding random words after the
>>> password and the authentication still succeeds.
>>
>> git http-backend does not handle authentication or authorization. This
>> is handled in your web server. You should consult your web server's
>> documentation, and maybe its configuration files.
>
> Very good advice.

In case someone is reading this thread I confirm the problem comes from
Apache.
-- 
Ivan Kanis, Release Manager, Vision Objects,

Le mal est un mulet : il est opiniâtre et stérile.
    -- Victor Hugo