Add a setting to allow anonymous access to individual gists while still RequireLogin everywhere else #229
Conversation
This is a middle ground between the existing setting "Require Login", which requires login to do anything at all, and having it off, which shows a public list of gists and more generally allows discovering info about the users/gists of the instance without login. The idea of this setting is that it is "require login" for everything except individual gists. Fixes thomiceli#228.
internal/ssh/git_ssh.go
Outdated
| @@ -37,7 +39,9 @@ func runGitCommand(ch ssh.Channel, gitCmd string, key string, ip string) error { | |||
| return errors.New("gist not found") | |||
| } | |||
|
|
|||
| requireLogin, err := db.GetSetting(db.SettingRequireLogin) | |||
| // FIXME: this seems to not actually work for clones, the auth process | |||
There was a problem hiding this comment.
Hi @lf- , sorry for the long delay
About this FIXME, does the bug occur when you enable RequireLogin and try to git clone another user gist ? Otherwise i'm not sure to encounter the bug or if it's something else
There was a problem hiding this comment.
Unrelated to this PR, but maybe related to the bug you're encountering, there is a wrong interaction with RequireLogin, when it's true, you can only pull/clone your own gists... which needs to be fixed ofc
There was a problem hiding this comment.
See #280 if this is the bug you're encountering
There was a problem hiding this comment.
Or maybe if you encountered this (i try to understand the fixme)
5:03AM ERR SSH: Failed to handshake error="[ssh: no auth passed yet, unknown public key]"
That means the ssh key git uses has not been added for your user into your opengist instance. If that's the case try to add the key and try again
There was a problem hiding this comment.
IIRC it doesn't even reach this code at all. I kind of forget the reproducer as well.
There was a problem hiding this comment.
I would assume it was the second bug i described..
|
Thanks for the PR |
This is a middle ground between the existing setting "Require Login",
which requires login to do anything at all, and having it off, which
shows a public list of gists and more generally allows discovering info
about the users/gists of the instance without login.
The idea of this setting is that it is "require login" for everything
except individual gists.
Fixes #228.