diff --git a/docker-compose.yml b/docker-compose.yml
index c12665d..f33ed98 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,7 @@
version: '3.3'
services:
+
redmine:
build:
context: ./redmine
@@ -25,6 +26,12 @@ services:
- db
- ldap
+ web-svn:
+ build:
+ context: ./web
+ ports:
+ - 8081:80
+
db:
image: mysql:5.7
#container_name: mysql
diff --git a/web/Dockerfile b/web/Dockerfile
new file mode 100644
index 0000000..e05b948
--- /dev/null
+++ b/web/Dockerfile
@@ -0,0 +1,11 @@
+FROM httpd:alpine
+#ADD ./httpd.conf /usr/local/apache2/conf/httpd.conf
+RUN apk update \
+ apk add apache2-mod-perl \
+ apache2-proxy \
+ mod_dav_svn \
+ perl-dbd-mysql \
+ perl-ldap \
+ subversion \
+ ;
+ADD ./Redmine.pm /usr/lib/perl5/Apache/Authn/Redmine.pm
diff --git a/web/Redmine.pm b/web/Redmine.pm
new file mode 100644
index 0000000..96b2aa6
--- /dev/null
+++ b/web/Redmine.pm
@@ -0,0 +1,560 @@
+package Apache::Authn::Redmine;
+
+=head1 Apache::Authn::Redmine
+
+Redmine - a mod_perl module to authenticate webdav subversion users
+against redmine database
+
+=head1 SYNOPSIS
+
+This module allow anonymous users to browse public project and
+registred users to browse and commit their project. Authentication is
+done against the redmine database or the LDAP configured in redmine.
+
+This method is far simpler than the one with pam_* and works with all
+database without an hassle but you need to have apache/mod_perl on the
+svn server.
+
+=head1 INSTALLATION
+
+For this to automagically work, you need to have a recent reposman.rb
+(after r860) and if you already use reposman, read the last section to
+migrate.
+
+Sorry ruby users but you need some perl modules, at least mod_perl2,
+DBI and DBD::mysql (or the DBD driver for you database as it should
+work on allmost all databases).
+
+On debian/ubuntu you must do :
+
+ aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
+
+If your Redmine users use LDAP authentication, you will also need
+Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
+
+ aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
+
+=head1 CONFIGURATION
+
+ ## This module has to be in your perl path
+ ## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm
+ PerlLoadModule Apache::Authn::Redmine
+
+ DAV svn
+ SVNParentPath "/var/svn"
+
+ AuthType Basic
+ AuthName redmine
+ Require valid-user
+
+ PerlAccessHandler Apache::Authn::Redmine::access_handler
+ PerlAuthenHandler Apache::Authn::Redmine::authen_handler
+
+ ## for mysql
+ RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
+ ## for postgres
+ # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
+
+ RedmineDbUser "redmine"
+ RedmineDbPass "password"
+ ## Optional where clause (fulltext search would be slow and
+ ## database dependent).
+ # RedmineDbWhereClause "and members.role_id IN (1,2)"
+ ## Optional credentials cache size
+ # RedmineCacheCredsMax 50
+
+
+To be able to browse repository inside redmine, you must add something
+like that :
+
+
+ DAV svn
+ SVNParentPath "/var/svn"
+ Order deny,allow
+ Deny from all
+ # only allow reading orders
+
+ Allow from redmine.server.ip
+
+
+
+and you will have to use this reposman.rb command line to create repository :
+
+ reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
+
+=head1 REPOSITORIES NAMING
+
+A project repository must be named with the project identifier. In case
+of multiple repositories for the same project, use the project identifier
+and the repository identifier separated with a dot:
+
+ /var/svn/foo
+ /var/svn/foo.otherrepo
+
+=head1 MIGRATION FROM OLDER RELEASES
+
+If you use an older reposman.rb (r860 or before), you need to change
+rights on repositories to allow the apache user to read and write
+S
+
+ sudo chown -R www-data /var/svn/*
+ sudo chmod -R u+w /var/svn/*
+
+And you need to upgrade at least reposman.rb (after r860).
+
+=head1 GIT SMART HTTP SUPPORT
+
+Git's smart HTTP protocol (available since Git 1.7.0) will not work with the
+above settings. Redmine.pm normally does access control depending on the HTTP
+method used: read-only methods are OK for everyone in public projects and
+members with read rights in private projects. The rest require membership with
+commit rights in the project.
+
+However, this scheme doesn't work for Git's smart HTTP protocol, as it will use
+POST even for a simple clone. Instead, read-only requests must be detected using
+the full URL (including the query string): anything that doesn't belong to the
+git-receive-pack service is read-only.
+
+To activate this mode of operation, add this line inside your
+block:
+
+ RedmineGitSmartHttp yes
+
+Here's a sample Apache configuration which integrates git-http-backend with
+a MySQL database and this new option:
+
+ SetEnv GIT_PROJECT_ROOT /var/www/git/
+ SetEnv GIT_HTTP_EXPORT_ALL
+ ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/
+
+ Order allow,deny
+ Allow from all
+
+ AuthType Basic
+ AuthName Git
+ Require valid-user
+
+ PerlAccessHandler Apache::Authn::Redmine::access_handler
+ PerlAuthenHandler Apache::Authn::Redmine::authen_handler
+ # for mysql
+ RedmineDSN "DBI:mysql:database=redmine;host=127.0.0.1"
+ RedmineDbUser "redmine"
+ RedmineDbPass "xxx"
+ RedmineGitSmartHttp yes
+
+
+Make sure that all the names of the repositories under /var/www/git/ have a
+matching identifier for some project: /var/www/git/myproject and
+/var/www/git/myproject.git will work. You can put both bare and non-bare
+repositories in /var/www/git, though bare repositories are strongly
+recommended. You should create them with the rights of the user running Redmine,
+like this:
+
+ cd /var/www/git
+ sudo -u user-running-redmine mkdir myproject
+ cd myproject
+ sudo -u user-running-redmine git init --bare
+
+Once you have activated this option, you have three options when cloning a
+repository:
+
+- Cloning using "http://user@host/git/repo(.git)" works, but will ask for the password
+ all the time.
+
+- Cloning with "http://user:pass@host/git/repo(.git)" does not have this problem, but
+ this could reveal accidentally your password to the console in some versions
+ of Git, and you would have to ensure that .git/config is not readable except
+ by the owner for each of your projects.
+
+- Use "http://host/git/repo(.git)", and store your credentials in the ~/.netrc
+ file. This is the recommended solution, as you only have one file to protect
+ and passwords will not be leaked accidentally to the console.
+
+ IMPORTANT NOTE: It is *very important* that the file cannot be read by other
+ users, as it will contain your password in cleartext. To create the file, you
+ can use the following commands, replacing yourhost, youruser and yourpassword
+ with the right values:
+
+ touch ~/.netrc
+ chmod 600 ~/.netrc
+ echo -e "machine yourhost\nlogin youruser\npassword yourpassword" > ~/.netrc
+
+=cut
+
+use strict;
+use warnings FATAL => 'all', NONFATAL => 'redefine';
+
+use DBI;
+use Digest::SHA;
+# optional module for LDAP authentication
+my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
+
+use Apache2::Module;
+use Apache2::Access;
+use Apache2::ServerRec qw();
+use Apache2::RequestRec qw();
+use Apache2::RequestUtil qw();
+use Apache2::Const qw(:common :override :cmd_how);
+use APR::Pool ();
+use APR::Table ();
+
+# use Apache2::Directive qw();
+
+my @directives = (
+ {
+ name => 'RedmineDSN',
+ req_override => OR_AUTHCFG,
+ args_how => TAKE1,
+ errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
+ },
+ {
+ name => 'RedmineDbUser',
+ req_override => OR_AUTHCFG,
+ args_how => TAKE1,
+ },
+ {
+ name => 'RedmineDbPass',
+ req_override => OR_AUTHCFG,
+ args_how => TAKE1,
+ },
+ {
+ name => 'RedmineDbWhereClause',
+ req_override => OR_AUTHCFG,
+ args_how => TAKE1,
+ },
+ {
+ name => 'RedmineCacheCredsMax',
+ req_override => OR_AUTHCFG,
+ args_how => TAKE1,
+ errmsg => 'RedmineCacheCredsMax must be decimal number',
+ },
+ {
+ name => 'RedmineGitSmartHttp',
+ req_override => OR_AUTHCFG,
+ args_how => TAKE1,
+ },
+);
+
+sub RedmineDSN {
+ my ($self, $parms, $arg) = @_;
+ $self->{RedmineDSN} = $arg;
+ my $query = "SELECT
+ users.hashed_password, users.salt, users.auth_source_id, roles.permissions, projects.status
+ FROM projects, users, roles
+ WHERE
+ users.login=?
+ AND projects.identifier=?
+ AND EXISTS (SELECT 1 FROM enabled_modules em WHERE em.project_id = projects.id AND em.name = 'repository')
+ AND users.type='User'
+ AND users.status=1
+ AND (
+ roles.id IN (SELECT member_roles.role_id FROM members, member_roles WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id)
+ OR
+ (cast(projects.is_public as CHAR) IN ('t', '1')
+ AND (roles.builtin=1
+ OR roles.id IN (SELECT member_roles.role_id FROM members, member_roles, users g
+ WHERE members.user_id = g.id AND members.project_id = projects.id AND members.id = member_roles.member_id
+ AND g.type = 'GroupNonMember'))
+ )
+ )
+ AND roles.permissions IS NOT NULL";
+ $self->{RedmineQuery} = trim($query);
+}
+
+sub RedmineDbUser { set_val('RedmineDbUser', @_); }
+sub RedmineDbPass { set_val('RedmineDbPass', @_); }
+sub RedmineDbWhereClause {
+ my ($self, $parms, $arg) = @_;
+ $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
+}
+
+sub RedmineCacheCredsMax {
+ my ($self, $parms, $arg) = @_;
+ if ($arg) {
+ $self->{RedmineCachePool} = APR::Pool->new;
+ $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
+ $self->{RedmineCacheCredsCount} = 0;
+ $self->{RedmineCacheCredsMax} = $arg;
+ }
+}
+
+sub RedmineGitSmartHttp {
+ my ($self, $parms, $arg) = @_;
+ $arg = lc $arg;
+
+ if ($arg eq "yes" || $arg eq "true") {
+ $self->{RedmineGitSmartHttp} = 1;
+ } else {
+ $self->{RedmineGitSmartHttp} = 0;
+ }
+}
+
+sub trim {
+ my $string = shift;
+ $string =~ s/\s{2,}/ /g;
+ return $string;
+}
+
+sub set_val {
+ my ($key, $self, $parms, $arg) = @_;
+ $self->{$key} = $arg;
+}
+
+Apache2::Module::add(__PACKAGE__, \@directives);
+
+
+my %read_only_methods = map { $_ => 1 } qw/GET HEAD PROPFIND REPORT OPTIONS/;
+
+sub request_is_read_only {
+ my ($r) = @_;
+ my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
+
+ # Do we use Git's smart HTTP protocol, or not?
+ if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp}) {
+ my $uri = $r->unparsed_uri;
+ my $location = $r->location;
+ my $is_read_only = $uri !~ m{^$location/*[^/]+/+(info/refs\?service=)?git\-receive\-pack$}o;
+ return $is_read_only;
+ } else {
+ # Standard behaviour: check the HTTP method
+ my $method = $r->method;
+ return defined $read_only_methods{$method};
+ }
+}
+
+sub access_handler {
+ my $r = shift;
+
+ unless ($r->some_auth_required) {
+ $r->log_reason("No authentication has been configured");
+ return FORBIDDEN;
+ }
+
+ return OK unless request_is_read_only($r);
+
+ my $project_id = get_project_identifier($r);
+
+ if (is_public_project($project_id, $r) && anonymous_allowed_to_browse_repository($project_id, $r)) {
+ $r->user("");
+ $r->set_handlers(PerlAuthenHandler => [\&OK]);
+ }
+
+ return OK
+}
+
+sub authen_handler {
+ my $r = shift;
+
+ my ($res, $redmine_pass) = $r->get_basic_auth_pw();
+ return $res unless $res == OK;
+
+ if (is_member($r->user, $redmine_pass, $r)) {
+ return OK;
+ } else {
+ $r->note_auth_failure();
+ return DECLINED;
+ }
+}
+
+# check if authentication is forced
+sub is_authentication_forced {
+ my $r = shift;
+
+ my $dbh = connect_database($r);
+ my $sth = $dbh->prepare(
+ "SELECT value FROM settings where settings.name = 'login_required';"
+ );
+
+ $sth->execute();
+ my $ret = 0;
+ if (my @row = $sth->fetchrow_array) {
+ if ($row[0] eq "1" || $row[0] eq "t") {
+ $ret = 1;
+ }
+ }
+ $sth->finish();
+ undef $sth;
+
+ $dbh->disconnect();
+ undef $dbh;
+
+ $ret;
+}
+
+sub is_public_project {
+ my $project_id = shift;
+ my $r = shift;
+
+ if (is_authentication_forced($r)) {
+ return 0;
+ }
+
+ my $dbh = connect_database($r);
+ my $sth = $dbh->prepare(
+ "SELECT is_public FROM projects
+ WHERE projects.identifier = ? AND projects.status <> 9
+ AND EXISTS (SELECT 1 FROM enabled_modules em WHERE em.project_id = projects.id AND em.name = 'repository');"
+ );
+
+ $sth->execute($project_id);
+ my $ret = 0;
+ if (my @row = $sth->fetchrow_array) {
+ if ($row[0] eq "1" || $row[0] eq "t") {
+ $ret = 1;
+ }
+ }
+ $sth->finish();
+ undef $sth;
+ $dbh->disconnect();
+ undef $dbh;
+
+ $ret;
+}
+
+sub anonymous_allowed_to_browse_repository {
+ my $project_id = shift;
+ my $r = shift;
+
+ my $dbh = connect_database($r);
+ my $sth = $dbh->prepare(
+ "SELECT permissions FROM roles WHERE permissions like '%browse_repository%'
+ AND (roles.builtin = 2
+ OR roles.id IN (SELECT member_roles.role_id FROM projects, members, member_roles, users
+ WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id
+ AND projects.identifier = ? AND users.type = 'GroupAnonymous'));"
+ );
+
+ $sth->execute($project_id);
+ my $ret = 0;
+ if (my @row = $sth->fetchrow_array) {
+ if ($row[0] =~ /:browse_repository/) {
+ $ret = 1;
+ }
+ }
+ $sth->finish();
+ undef $sth;
+ $dbh->disconnect();
+ undef $dbh;
+
+ $ret;
+}
+
+# perhaps we should use repository right (other read right) to check public access.
+# it could be faster BUT it doesn't work for the moment.
+# sub is_public_project_by_file {
+# my $project_id = shift;
+# my $r = shift;
+
+# my $tree = Apache2::Directive::conftree();
+# my $node = $tree->lookup('Location', $r->location);
+# my $hash = $node->as_hash;
+
+# my $svnparentpath = $hash->{SVNParentPath};
+# my $repos_path = $svnparentpath . "/" . $project_id;
+# return 1 if (stat($repos_path))[2] & 00007;
+# }
+
+sub is_member {
+ my $redmine_user = shift;
+ my $redmine_pass = shift;
+ my $r = shift;
+
+ my $project_id = get_project_identifier($r);
+
+ my $pass_digest = Digest::SHA::sha1_hex($redmine_pass);
+
+ my $access_mode = request_is_read_only($r) ? "R" : "W";
+
+ my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
+ my $usrprojpass;
+ if ($cfg->{RedmineCacheCredsMax}) {
+ $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id.":".$access_mode);
+ return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
+ }
+ my $dbh = connect_database($r);
+ my $query = $cfg->{RedmineQuery};
+ my $sth = $dbh->prepare($query);
+ $sth->execute($redmine_user, $project_id);
+
+ my $ret;
+ while (my ($hashed_password, $salt, $auth_source_id, $permissions, $project_status) = $sth->fetchrow_array) {
+ if ($project_status eq "9" || ($project_status ne "1" && $access_mode eq "W")) {
+ last;
+ }
+
+ unless ($auth_source_id) {
+ my $method = $r->method;
+ my $salted_password = Digest::SHA::sha1_hex($salt.$pass_digest);
+ if ($hashed_password eq $salted_password && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
+ $ret = 1;
+ last;
+ }
+ } elsif ($CanUseLDAPAuth) {
+ my $sthldap = $dbh->prepare(
+ "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
+ );
+ $sthldap->execute($auth_source_id);
+ while (my @rowldap = $sthldap->fetchrow_array) {
+ my $bind_as = $rowldap[3] ? $rowldap[3] : "";
+ my $bind_pw = $rowldap[4] ? $rowldap[4] : "";
+ if ($bind_as =~ m/\$login/) {
+ # replace $login with $redmine_user and use $redmine_pass
+ $bind_as =~ s/\$login/$redmine_user/g;
+ $bind_pw = $redmine_pass
+ }
+ my $ldap = Authen::Simple::LDAP->new(
+ host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],
+ port => $rowldap[1],
+ basedn => $rowldap[5],
+ binddn => $bind_as,
+ bindpw => $bind_pw,
+ filter => "(".$rowldap[6]."=%s)"
+ );
+ my $method = $r->method;
+ $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));
+
+ }
+ $sthldap->finish();
+ undef $sthldap;
+ }
+ }
+ $sth->finish();
+ undef $sth;
+ $dbh->disconnect();
+ undef $dbh;
+
+ if ($cfg->{RedmineCacheCredsMax} and $ret) {
+ if (defined $usrprojpass) {
+ $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest);
+ } else {
+ if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
+ $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest);
+ $cfg->{RedmineCacheCredsCount}++;
+ } else {
+ $cfg->{RedmineCacheCreds}->clear();
+ $cfg->{RedmineCacheCredsCount} = 0;
+ }
+ }
+ }
+
+ $ret;
+}
+
+sub get_project_identifier {
+ my $r = shift;
+
+ my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
+ my $location = $r->location;
+ $location =~ s/\.git$// if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp});
+ my ($identifier) = $r->uri =~ m{$location/*([^/.]+)};
+ $identifier;
+}
+
+sub connect_database {
+ my $r = shift;
+
+ my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
+ return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
+}
+
+1;
diff --git a/web/httpd.conf b/web/httpd.conf
new file mode 100644
index 0000000..e69de29