#57 repo.git publishes local filesystem path in config

closedsecurityopened
details
updated
id
ebb9556e-9e38-4ba0-8081-2b71e45cd51e

dist/repo.git/config is published and contains the builder's absolute filesystem path.

$ curl -s http://127.0.0.1:39313/repo.git/config
[core]
	repositoryformatversion = 0
	filemode = true
	bare = true
[remote "origin"]
	url = ~/src/code/gl0w-w0rld/hu13

git clone records remote.origin.url pointing at the source path, and every file under repo.git/ is served verbatim. That leaks the deploy host's directory layout and username (/home/<user>/src/...) to the public.

Also published and useless: description (the "Unnamed repository" stub) and 14 hooks/*.sample files.

Fix, after the clone:

Acceptance:

Comments (1)

all issues