mirror of
https://github.com/dokku/dokku.git
synced 2026-05-18 13:15:19 +02:00
6eb8b8632c
The previous use of `touch` before `netrc set` allowed the file to inherit the umask and be world-readable, exposing stored git credentials to local users. The set and unset paths now explicitly chmod 0600 and chown to the dokku user, and the plugin install hook repairs permissions on already-affected installations.
50 lines
1.6 KiB
Bash
Executable File
50 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -eo pipefail
|
|
[[ $DOKKU_TRACE ]] && set -x
|
|
source "$PLUGIN_CORE_AVAILABLE_PATH/common/functions"
|
|
source "$PLUGIN_CORE_AVAILABLE_PATH/common/property-functions"
|
|
source "$PLUGIN_AVAILABLE_PATH/config/functions"
|
|
|
|
trigger-git-install() {
|
|
declare desc="installs the git plugin"
|
|
declare trigger="install"
|
|
|
|
mkdir -p "${DOKKU_LIB_ROOT}/data/git"
|
|
chown -R "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "${DOKKU_LIB_ROOT}/data/git"
|
|
|
|
fn-plugin-property-setup "git"
|
|
migrate_git_vars_0_12_0 "$@"
|
|
migrate_netrc_permissions "$@"
|
|
}
|
|
|
|
migrate_netrc_permissions() {
|
|
declare desc="enforces 0600 permissions on a pre-existing .netrc from older dokku versions"
|
|
local netrc_file="${DOKKU_ROOT}/.netrc"
|
|
|
|
[[ ! -f "$netrc_file" ]] && return 0
|
|
|
|
chmod 600 "$netrc_file"
|
|
chown "${DOKKU_SYSTEM_USER}:${DOKKU_SYSTEM_GROUP}" "$netrc_file"
|
|
}
|
|
|
|
migrate_git_vars_0_12_0() {
|
|
declare desc="migrates git config variables from 0.11.x"
|
|
local DOKKU_DEPLOY_BRANCH app
|
|
|
|
DOKKU_DEPLOY_BRANCH=$(config_get --global DOKKU_DEPLOY_BRANCH || true)
|
|
if [[ -n "$DOKKU_DEPLOY_BRANCH" ]]; then
|
|
fn-plugin-property-write "git" --global "deploy-branch" "$DOKKU_DEPLOY_BRANCH"
|
|
DOKKU_QUIET_OUTPUT=1 config_unset --global DOKKU_DEPLOY_BRANCH || true
|
|
fi
|
|
|
|
for app in $(dokku_apps "false" 2>/dev/null); do
|
|
DOKKU_DEPLOY_BRANCH=$(config_get "$app" DOKKU_DEPLOY_BRANCH || true)
|
|
if [[ -n "$DOKKU_DEPLOY_BRANCH" ]]; then
|
|
fn-plugin-property-write "git" "$app" "deploy-branch" "$DOKKU_DEPLOY_BRANCH"
|
|
DOKKU_QUIET_OUTPUT=1 config_unset --no-restart "$app" DOKKU_DEPLOY_BRANCH || true
|
|
fi
|
|
done
|
|
}
|
|
|
|
trigger-git-install "$@"
|