Have git-cvsserver call hooks/update before really altering the ref

git-cvsserver is analogous to git-receive-pack; a checking from a cvs
client to a central server is like a git-push from a working repository.
Therefore it's nice to use the same access control (and email sending)
that a receive-pack would perform.

This patch tests for an executable update hook; if it is it is run with
the ref being updated and the old and new hashes as normal.  If the
update hook returns an error code the update is aborted and the ref is
never updated.  The cvsserver returns "error 1" to the client to signal
there was an EPERM error.

Signed-off-by: Andy Parkins <andyparkins@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>

diff --git a/git-cvsserver.perl b/git-cvsserver.perl
index 9371788fab427ab8605cb8c993a1520e36ad819e..84520e7ad5c1745b14db2206189bb7d54c17dcc8 100755 (executable)
--- a/git-cvsserver.perl
+++ b/git-cvsserver.perl
@@ -1171,6 +1171,21 @@ sub req_ci
         exit;
     }
 
+       # Check that this is allowed, just as we would with a receive-pack
+       my @cmd = ( $ENV{GIT_DIR}.'hooks/update', "refs/heads/$state->{module}",
+                       $parenthash, $commithash );
+       if( -x $cmd[0] ) {
+               unless( system( @cmd ) == 0 )
+               {
+                       $log->warn("Commit failed (update hook declined to update ref)");
+                       print "error 1 Commit failed (update hook declined)\n";
+                       close LOCKFILE;
+                       unlink($lockfile);
+                       chdir "/";
+                       exit;
+               }
+       }
+
     print LOCKFILE $commithash;
 
     $updater->update();