From 026ba9850f93b45d164fcf69a58727e2bcdd2580 Mon Sep 17 00:00:00 2001
From: "Kyle J. McKay" <mackyle@gmail.com>
Date: Sat, 15 Aug 2020 14:44:26 -0700
Subject: [PATCH] cloning: enforce $Girocco::Config::max_clone_objects

When cloning a new project, enforce the new
$Girocco::Config::max_clone_objects limit.

Additionally, if the clone ends up failing because the limit was
exceeded, immediately remove all files in the objects subdirectory
hierarchy, include an "objects exceeded" blurb in the failure message
and always cc the configured admin address in such a case regardless
of the admincc setting.

Signed-off-by: Kyle J. McKay <mackyle@gmail.com>
---
 taskd/clone.sh | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/taskd/clone.sh b/taskd/clone.sh
index 69509f3..2989a64 100755
--- a/taskd/clone.sh
+++ b/taskd/clone.sh
@@ -84,6 +84,7 @@ clear_all_objects_and_packs() {
 }
 
 exit_err=0
+exit_objs=0
 send_clone_failed() {
 	trap "" EXIT
 	# We must now close the .clonelog file that is open on stdout and stderr
@@ -113,12 +114,20 @@ send_clone_failed() {
 The source repository${reposize:+ ($reposize)} exceeds our maximum allowed repository size."
 		clear_all_objects_and_packs
 	fi
+	xobjs_err=""
+	if [ "${exit_objs:-0}" != "0" ]; then
+		ccadm=1
+		xobjs_err="
+
+The source repository${exit_objs:+ ($exit_objs objects)} exceeds our maximum allowed object limit."
+		clear_all_objects_and_packs
+	fi
 	[ "$ccadm" = "0" ] || [ -z "$cfg_admin" ] ||
 	if [ -z "$failaddrs" ]; then failaddrs="$cfg_admin"; else failaddrs="$failaddrs,$cfg_admin"; fi
 	[ -z "$failaddrs" ] ||
 	{
 	      cat <<EOT
-Condolences. The clone of project $proj just failed.$xfsz_err
+Condolences. The clone of project $proj just failed.$xfsz_err$xobjs_err
 
 	* Source URL: $url
 	* Project settings: $cfg_webadmurl/editproj.cgi?name=$(echo "$proj" | LC_ALL=C sed -e 's/[+]/%2B/g')
@@ -617,6 +626,15 @@ case "$url" in
 		;;
 esac
 
+# Check the max_clone_objects setting now (if set)
+if [ "${cfg_max_clone_objects:-0}" != "0" ]; then
+	objcount="$(git count-objects -v | LC_ALL=C awk 'BEGIN{v=0}/^count:/||/^in-pack:/{v+=$2}END{print v}')" || :
+	if [ -n "$objcount" ] && [ "$objcount" -gt "$cfg_max_clone_objects" ]; then
+		exit_objs="$objcount"
+		exit 1 # fail the clone
+	fi
+fi
+
 # The objects subdirectories permissions must be updated now.
 # In the case of a dumb http clone, the permissions will not be correct
 # (missing group write) despite the core.sharedrepository=1 setting!
-- 
2.11.4.GIT