Skip to content

Commit f5105e9

Browse files
committed
Fix /verify LFS handler expecting wrong content-type
According to [spec](https://github.com/git-lfs/git-lfs/blob/master/docs/api/basic-transfers.md#verification), /verify requests must have "Accept: application/vnd.git-lfs+json" Previous code worked just because native `git-lfs` implementation *replaced* Accept header that is required by spec with value given by Gitea ("application/vnd.git-lfs"), however this 1. Doesn't apply to other clients, at least `git-lfs-java` *appends* headers instead of replacing them 2. Forces client to violate spec and send unexpected Accept header
1 parent 56ae539 commit f5105e9

File tree

1 file changed

+6
-17
lines changed

1 file changed

+6
-17
lines changed

modules/lfs/server.go

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@ import (
2222
)
2323

2424
const (
25-
contentMediaType = "application/vnd.git-lfs"
26-
metaMediaType = contentMediaType + "+json"
25+
metaMediaType = "application/vnd.git-lfs+json"
2726
)
2827

2928
// RequestVars contain variables from the HTTP request. Variables from routing, json body decoding, and
@@ -101,11 +100,10 @@ func ObjectOidHandler(ctx *context.Context) {
101100
getMetaHandler(ctx)
102101
return
103102
}
104-
if ContentMatcher(ctx.Req) || len(ctx.Params("filename")) > 0 {
105-
getContentHandler(ctx)
106-
return
107-
}
108-
} else if ctx.Req.Method == "PUT" && ContentMatcher(ctx.Req) {
103+
104+
getContentHandler(ctx)
105+
return
106+
} else if ctx.Req.Method == "PUT" {
109107
PutHandler(ctx)
110108
return
111109
}
@@ -348,7 +346,7 @@ func VerifyHandler(ctx *context.Context) {
348346
return
349347
}
350348

351-
if !ContentMatcher(ctx.Req) {
349+
if !MetaMatcher(ctx.Req) {
352350
writeStatus(ctx, 400)
353351
return
354352
}
@@ -385,7 +383,6 @@ func Represent(rv *RequestVars, meta *models.LFSMetaObject, download, upload boo
385383
}
386384

387385
header := make(map[string]string)
388-
header["Accept"] = contentMediaType
389386

390387
if rv.Authorization == "" {
391388
//https://github.com/github/git-lfs/issues/1088
@@ -410,14 +407,6 @@ func Represent(rv *RequestVars, meta *models.LFSMetaObject, download, upload boo
410407
return rep
411408
}
412409

413-
// ContentMatcher provides a mux.MatcherFunc that only allows requests that contain
414-
// an Accept header with the contentMediaType
415-
func ContentMatcher(r macaron.Request) bool {
416-
mediaParts := strings.Split(r.Header.Get("Accept"), ";")
417-
mt := mediaParts[0]
418-
return mt == contentMediaType
419-
}
420-
421410
// MetaMatcher provides a mux.MatcherFunc that only allows requests that contain
422411
// an Accept header with the metaMediaType
423412
func MetaMatcher(r macaron.Request) bool {

0 commit comments

Comments
 (0)