If you set policy.allow-public to true and force a repositories visibility to less than public you get a 404 response code instead of a 401 which prompts for auth details in git/mercurial.
You hit this: https://secure.phabricator.com/diffusion/P/browse/master/src/applications/diffusion/controller/DiffusionServeController.php;348ca4207c1c5757a7f1797fa181d4d9bec2f09f$102
instead of this which you hit without policy.allow-public: https://secure.phabricator.com/diffusion/P/browse/master/src/applications/diffusion/controller/DiffusionServeController.php;348ca4207c1c5757a7f1797fa181d4d9bec2f09f$87
In other words, it seems that the repository fetch never throws the appropriate policy exception.
Description
Description
Related Objects
Related Objects
- Mentioned In
- T9771: Objects which are restricted because of Spaces render as "Unknown" instead of "Restricted"
T8798: Spaces - diffusion - http authentication - Mentioned Here
- T9771: Objects which are restricted because of Spaces render as "Unknown" instead of "Restricted"
rP535c1a5f255e: (stable) Fix public/private profile edit note
T8798: Spaces - diffusion - http authentication
Event Timeline
Comment Actions
If you set non public and you do a:
git -c core.askpass=true ls-remote -h ...
you get a 403
Comment Actions
For what it's worth, I can only recreate this issue if I use Spaces (which T8798 already mentioned). I'm on the latest stable (rP535c1a5f255e0da69ea5fbfb230b699eb5a152b1) with a dummy git repo set to project member visibility, and I tried cloning the dummy repo under the following conditions:
| policy.allow-public==true | policy.allow-public==false | |
| No spaces | Cloned successfully | Cloned successfully |
| Created Default space with Public visibility | Cloned successfully | Cloned successfully |
| Changed Default space to All Users visibility | Repository not found | Cloned successfully |
| Shifted repo to a second space that had Public visibility | Cloned successfully | Cloned successfully |
| Changed second space to All Users visibility | Repository not found | Cloned successfully |
Basically, iff policy.allow-public is true AND my repo is in a non-public space, then I can't clone the repo over HTTP(S). Unlike what @mikn originally described, though, I don't have any trouble when the repository itself has non-public visibility; it's only when it's in a non-public space.
Comment Actions
This is expected with Spaces, which completely hide objects (primarily as a performance consideration). I'm going to merge this into T9771 which discusses this issue more broadly.