Missing allowed commands for anonymous users
In Heptapod 0.3.0, anonymous clones work, but anonymous pulls can often fail. That's because the discovery and obshashrange commands are still not allowed for anonymous users.
Noticed after reconfiguring mirror.octobus.net to use the present instance as its upstream.
Hotfix:
diff -r d73ffab8aeb1 app/controllers/projects/hg_http_controller.rb
--- a/app/controllers/projects/hg_http_controller.rb Fri May 24 22:37:25 2019 +0200
+++ b/app/controllers/projects/hg_http_controller.rb Wed Jun 05 20:46:11 2019 +0000
@@ -96,7 +96,7 @@
private
def download_request?
- %w{ capabilities batch getbundle }.include?(params[:cmd]) && params[:action] == 'hg'
+ %w{ capabilities batch getbundle heads known evoext_obshashrange_v1 }.include?(params[:cmd]) && params[:action] == 'hg'
end
# TODO: check necessity to keep this
Of course a better fix would be to sync with the DOWNLOAD_COMMAND
constant of lib/gitlab/hg_access.rb