closes #6827

[arvados.git] / services / arv-git-httpd / auth_handler.go

diff --git a/services/arv-git-httpd/auth_handler.go b/services/arv-git-httpd/auth_handler.go
index b2e91decc650336aa4bef82fdbad4fb5866e9862..b284f19153b4ca8c07599d2b90957bcbb77e4ec4 100644 (file)
--- a/services/arv-git-httpd/auth_handler.go
+++ b/services/arv-git-httpd/auth_handler.go
@@ -52,7 +52,19 @@ func (h *authHandler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
                        w.WriteHeader(statusCode)
                        w.Write([]byte(statusText))
                }
-               log.Println(quoteStrings(r.RemoteAddr, username, password, wroteStatus, statusText, repoName, r.URL.Path)...)
+
+    // If the given password is a valid token, log the first 10 characters of the token.
+    // Otherwise: log the string <invalid> if a password is given, else an empty string.
+               passwordToLog := ""
+               if statusCode == 401 || strings.Contains(statusText, "Unauthorized") {
+                       if len(password) > 0 {
+                               passwordToLog = "<invalid>"
+                       }
+               } else {
+                       passwordToLog = password[0:10]
+               }
+
+               log.Println(quoteStrings(r.RemoteAddr, username, passwordToLog, wroteStatus, statusText, repoName, r.Method, r.URL.Path)...)
        }()
 
        // HTTP request username is logged, but unused. Password is an
@@ -60,7 +72,7 @@ func (h *authHandler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        username, password, ok := BasicAuth(r)
        if !ok || username == "" || password == "" {
                statusCode, statusText = http.StatusUnauthorized, "no credentials provided"
-               w.Header().Add("WWW-Authenticate", "basic")
+               w.Header().Add("WWW-Authenticate", "Basic realm=\"git\"")
                return
        }
 
@@ -87,7 +99,7 @@ func (h *authHandler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        arv.ApiToken = password
        reposFound := arvadosclient.Dict{}
        if err := arv.List("repositories", arvadosclient.Dict{
-               "filters": [][]string{[]string{"name", "=", repoName}},
+               "filters": [][]string{{"name", "=", repoName}},
        }, &reposFound); err != nil {
                statusCode, statusText = http.StatusInternalServerError, err.Error()
                return
@@ -135,7 +147,6 @@ func (h *authHandler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
                "/" + repoName + "/.git",
        }
        for _, dir := range tryDirs {
-               log.Println("Trying", theConfig.Root + dir)
                if fileInfo, err := os.Stat(theConfig.Root + dir); err != nil {
                        if !os.IsNotExist(err) {
                                statusCode, statusText = http.StatusInternalServerError, err.Error()
@@ -147,6 +158,8 @@ func (h *authHandler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
                }
        }
        if rewrittenPath == "" {
+               log.Println("WARNING:", repoUUID,
+                       "git directory not found in", theConfig.Root, tryDirs)
                // We say "content not found" to disambiguate from the
                // earlier "API says that repo does not exist" error.
                statusCode, statusText = http.StatusNotFound, "content not found"