[PR #5367] [MERGED] Explicitly disable Git credential helper #17769

New Issue

GiteaMirror · 2025-11-02T15:37:55-06:00

GiteaMirror commented

2025-11-02 15:37:55 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/5367
Author: @michaelkuhn
Created: 11/20/2018
Status: ✅ Merged
Merged: 11/28/2018
Merged by: @lafriks

Base: master ← Head: credential-helper

📝 Commits (2)

9806777 Explicitly disable Git credential helper
6f15705 Update git module

📊 Changes

6 files changed (+51 additions, -25 deletions)

View changed files

📝 Gopkg.lock (+2 -2)
📝 modules/setting/setting.go (+12 -17)
📝 vendor/code.gitea.io/git/command.go (+4 -1)
📝 vendor/code.gitea.io/git/repo_tree.go (+9 -0)
📝 vendor/code.gitea.io/git/tree.go (+14 -0)
📝 vendor/code.gitea.io/git/tree_entry.go (+10 -5)

📄 Description

If the user running Gitea has configured a credential helper, Git credentials might leak out of Gitea.

There are two problems with credential helpers when combined with Gitea:

Credentials entered by a user when doing a migration or setting up a mirror will end up in the credential store. In the worst case, this is the plain text file ~/.git-credentials.
Credentials in the credential store will be used for migrations and mirrors by all users. For example, if user A sets up a mirror, their credentials will be stored. If user B later sets up a mirror from the same host and does not enter any credentials, user A's credentials will be used.

This PR prepends -c credential.helper= to all Git commands to clear the list of helpers. This requires at least Git version 2.9, as previous versions will try to load an empty helper instead. For more details, see 24321375cd

(Related to #3966)

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/5367 **Author:** [@michaelkuhn](https://github.com/michaelkuhn) **Created:** 11/20/2018 **Status:** ✅ Merged **Merged:** 11/28/2018 **Merged by:** [@lafriks](https://github.com/lafriks) **Base:** `master` ← **Head:** `credential-helper` --- ### 📝 Commits (2) - [`9806777`](https://github.com/go-gitea/gitea/commit/98067778033ac375907b05ca42da244602864161) Explicitly disable Git credential helper - [`6f15705`](https://github.com/go-gitea/gitea/commit/6f15705e834c5322574fcfbddd666c11cbdd3753) Update git module ### 📊 Changes **6 files changed** (+51 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `Gopkg.lock` (+2 -2) 📝 `modules/setting/setting.go` (+12 -17) 📝 `vendor/code.gitea.io/git/command.go` (+4 -1) 📝 `vendor/code.gitea.io/git/repo_tree.go` (+9 -0) 📝 `vendor/code.gitea.io/git/tree.go` (+14 -0) 📝 `vendor/code.gitea.io/git/tree_entry.go` (+10 -5) </details> ### 📄 Description If the user running Gitea has configured a credential helper, Git credentials might leak out of Gitea. There are two problems with credential helpers when combined with Gitea: 1. Credentials entered by a user when doing a migration or setting up a mirror will end up in the credential store. In the worst case, this is the plain text file ~/.git-credentials. 2. Credentials in the credential store will be used for migrations and mirrors by all users. For example, if user A sets up a mirror, their credentials will be stored. If user B later sets up a mirror from the same host and does not enter any credentials, user A's credentials will be used. This PR prepends -c credential.helper= to all Git commands to clear the list of helpers. This requires at least Git version 2.9, as previous versions will try to load an empty helper instead. For more details, see https://github.com/git/git/commit/24321375cda79f141be72d1a842e930df6f41725 (Related to #3966) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 15:37:56 -06:00

GiteaMirror closed this issue

2025-11-02 15:38:07 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17769