Skip to content

Make sure an unauthorized authenticated pull gives a 404

Georges Racinet requested to merge topic/heptapod/unauth_404 into branch/heptapod

Without this change, a clone on a private repo by an authenticated user that doesn't have read permissions gives an error 500, which isn't user-friendly and can be considered a minor information leak.

Kept catching the GitAccess exception mostly in case, I'm not sure whether it's supposed to happen with Heptapod.

--HG-- branch : heptapod

Edited by Georges Racinet

Merge request reports