**Whitelist-Push** and **MergePullrequest** does not work when Branch-Protection is enabled

[sharpSteff]

• Gitea version (or commit ref):
  1.9.0+3-g6d441de
• Go Version
  1.11.5
• Git version:
  2.7.4
• Operating system:
  LXC container on ubuntu 16.04 LTS
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist:

Description

Whitelist-Push and MergePullrequest does not work when Branch-Protection is enabled:

Pushing develop
Enumerating objects: 7, done.
Delta compression using up to 12 threads
Total 4 (delta 3), reused 0 (delta 0)
POST git-receive-pack (530 bytes)
Remote: Gitea: Internal Server Error        
Remote: Fail to detect force push: exit status 128 - fatal: Not a git repository (or any parent up to mount point /srv/git)        
Remote: Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).        
Remote: 
Pushing to myserver
To myserver
Error: failed to push some refs to 'myserver'

Merging Pullrequests returns 500 Error

With Gitea 1.8.3+2-g11f6ed4 everything works just fine.

Screenshots

[lunny]

Cannot reproduce this on my local

[zeripath]

We need to see the Gitea log.

[sharpSteff]

@lunny I also can not produce this bug on try.gitea.to
Might be related to our infrastructure (dynamic proxy, etc..)

I think 356854f has something to do with this.

before:

.....

// detect force push
if git.EmptySHA != oldCommitID {
	output, err := git.NewCommand("rev-list", "--max-count=1", oldCommitID, "^"+newCommitID).RunInDir(repoPath)

	if err != nil {
		fail("Internal error", "Fail to detect force push: %v", err)
	} else if len(output) > 0 {
		fail(fmt.Sprintf("branch %s is protected from force push", branchName), "")
	}
}
.....

after

if git.EmptySHA != oldCommitID {
	env := append(os.Environ(),
		private.GitAlternativeObjectDirectories+"="+gitAlternativeObjectDirectories,
		private.GitObjectDirectory+"="+gitObjectDirectory,
		private.GitQuarantinePath+"="+gitObjectDirectory,
	)

	output, err := git.NewCommand("rev-list", "--max-count=1", oldCommitID, "^"+newCommitID).RunInDirWithEnv(repo.RepoPath(), env)
	if err != nil {
		log.Error("Unable to detect force push between: %s and %s in %-v Error: %v", oldCommitID, newCommitID, repo, err)
		ctx.JSON(http.StatusInternalServerError, map[string]interface{}{
			"err": fmt.Sprintf("Fail to detect force push: %v", err),
		})
		return
	} else if len(output) > 0 {
		log.Warn("Forbidden: Branch: %s in %-v is protected from force push", branchName, repo)
		ctx.JSON(http.StatusForbidden, map[string]interface{}{
			"err": fmt.Sprintf("branch %s is protected from force push", branchName),
		})
		return

	}
}

I'll try to provide the gitea log.
We downgraded to 1.8.3+2-g11f6ed4 , so it might take some time

[zeripath]

Ah.

I've figured this out.

That repo path needs to be prefixed with the Gitea repository path.

You're running Gitea from a weird working directory meaning that repo.RepoPath() won't work.

---

Nope this was totally wrong.

[jdehaan]

I am taking care of the infrastructure for the system on which the problem was found by @sharpSteff.

INFO: Gitea is running behind a reverse proxy mapping the server to a sub-directory (/git).

As mentioned rolling back to HEAD of 1.8 branch solves the issue, there must be something breaking in 1.9 regarding such setups. Is this information enough?

[jdehaan]

I could find the related entry in the log file (the xxxxx and yyyyyy are anonymizing internal names):

2019/08/05 06:29:28 .../xorm/session_get.go:99:nocacheGet() [I] [SQL] SELECT `id`, `repo_id`, `branch_name`, `can_push`, `enable_whitelist`, `whitelist_user_i_ds`, `whitelist_team_i_ds`, `e
2019/08/05 06:29:28 ...ters/private/hook.go:74:HookPreReceive() [E] Unable to detect force push between: aa77e1d18966bf5c48b9b913db3c857c9bfbabe9 and 62d7b4ea78941e254f95a38831c20f1a17e5361
        Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
        
2019/08/05 06:29:28 routers/repo/pull.go:629:MergePullRequest() [E] Merge: git push: From /srv/git/xxxx/yyyyyy.xxxx
         * branch            develop    -> FETCH_HEAD
         * [new branch]      develop    -> head_repo/develop
        Switched to a new branch 'head_repo_develop'
        .git/rebase-apply/patch:11: trailing whitespace.
                                        bat "AdvancedInstaller.com /edit ${AdvancedInstallerSetupFile} /SetAppdir -path [ProgramFilesFolder]YYY\\[ProductName] -buildname Build"\01503d
        .git/rebase-apply/patch:12: trailing whitespace.
                                        bat "AdvancedInstaller.com /edit ${AdvancedInstallerSetupFile} /SetAppdir -path [ProgramFilesFolder]YYY\\[ProductName] -buildname DefaultBuild"\01503
        warning: 2 lines add whitespace errors.
        Switched to branch 'master'
        remote: Gitea: Internal Server Error        
        remote: Fail to detect force push: exit status 128 - fatal: Not a git repository (or any parent up to mount point /srv/git)
        remote: Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).
        remote: 
        To /srv/git/xxxx/yyyyyy.xxxx.git
         ! [remote rejected] master -> master (pre-receive hook declined)
        error: failed to push some refs to '/srv/git/xxxx/yyyyyy.xxxx.git'

[lunny]

I think maybe environments break it.

env := append(os.Environ(),
		private.GitAlternativeObjectDirectories+"="+gitAlternativeObjectDirectories,
		private.GitObjectDirectory+"="+gitObjectDirectory,
		private.GitQuarantinePath+"="+gitObjectDirectory,
	)

We can remove these. But I can't reproduce that locally.

[lafriks]

@lunny hooks will not work without these environment variables. It should be something to do with specific configuration (gitea workdir, homedir or app.ini paths)

[jdehaan]

part of app.ini:

[repository]
ROOT = /srv/git

[server]
SSH_DOMAIN       = xxxxx.de
SSH_PORT         = 2222
SSH_LISTEN_PORT  = 2222
START_SSH_SERVER = true
DISABLE_SSH      = false
DOMAIN           = xxxxx.de
HTTP_PORT        = 3000
ROOT_URL         = https://xxxxx.de/git/
LFS_START_SERVER = false
OFFLINE_MODE     = true

[log]
MODE      = file
LEVEL     = Info
ROOT_PATH = /root/go/src/code.gitea.io/gitea/log

[lunny]

repository.ROOT is where you store your all git repositories. could you confirm you have permissions on that directory?

[jdehaan]

I could find some path information here:

[lafriks]

what is workdir in service file specified and what is home directory for git user?

[jdehaan]

The service file is:

[Unit]
Description=Gitea (Git with a cup of tea)
After=syslog.target
After=network.target
After=mysqld.service

[Service]
Type=simple
User=git
Group=git
WorkingDirectory=/root/go/src/code.gitea.io/gitea
ExecStart=/root/go/src/code.gitea.io/gitea/gitea web
Restart=always
Environment=USER=root HOME=/root

[Install]
WantedBy=multi-user.target

[jdehaan]

/home/git is the home of user git

BTW the permissions inside /srv/git/ look ok, everything owned by git.git