[issue298] push over http and acl extension are using different approaches for determining principal

[Mikhail Sobolev]

New submission from Mikhail Sobolev <mikhail.sobolev at gmail.com>:

There are two places where you can somehow apply ACLs to the incoming requests:
[web] section for push over http, and [acl.allow], [acl.deny] for hgext/acl.py
extension.

After looking at the configuration possibilities, I found that
allow_push/deny_push somehow copy the functionality in acl.py. However the
latter does not make use of the user obtained in hgweb_mod.py, it uses the user
that runs the script, which makes it impossible to use fine-grained access
control offered by acl extension, while, for example, serving repository using
hgwebdir.cgi.

----------
messages: 1595
nosy: MishaS
priority: wish
status: unread
title: push over http and acl extension are using different approaches for determining principal
topic: hgweb

____________________________________________________
Mercurial issue tracker <mercurial-bugs at selenic.com>
<http://www.selenic.com/mercurial/bts/issue298>
____________________________________________________