[PATCH_v1] add git credential login to remote mediawiki

From: Javier Roucher <redacted>


This path uses git credential to store the login/password of the mediawiki.


Signed-off-by: Pavel Volek <redacted>
Signed-off-by: NGUYEN Kim Thuat <redacted>
Signed-off-by: ROUCHER IGLESIAS Javier <redacted>
Signed-off-by: Matthieu Moy <redacted>
---
 contrib/mw-to-git/git-remote-mediawiki | 107 +++++++++++++++++++++++++++++----
 1 file changed, 95 insertions(+), 12 deletions(-)

diff --git a/contrib/mw-to-git/git-remote-mediawiki b/contrib/mw-to-git/git-remote-mediawiki
index c18bfa1..4b14d78 100755
--- a/contrib/mw-to-git/git-remote-mediawiki
+++ b/contrib/mw-to-git/git-remote-mediawiki

@@ -152,28 +152,111 @@ while (<STDIN>) {
 ########################## Functions ##############################
 
 # MediaWiki API instance, created lazily.
+sub run_credential {
+	my $cre_protocol = "";
+	my $cre_host = "";
+	my $cre_path = "";
+	my $msg = "";
+	my $result = "";
+	my $op=$_[0];
+	if (scalar(@_) == 2) {
+		if ($_[1] eq ("store" || "cache")) {
+			run_git("config credential.helper \'$_[1]\'");
+		} else {
+			print STDERR "ERROR: run_credential (fill|approve|reject) [store|cache]\n";
+			exit 1;
+		}
+	}
+	my $parsed = URI->new($url);
+	$cre_protocol = $parsed->scheme;
+	$cre_host = $parsed->host;
+	$cre_path = $parsed->path;
+
+        if ($wiki_login ne "") {
+                $msg .= "username=$wiki_login\n";
+        }
+        if ($wiki_passwd ne "") {
+                $msg .= "password=$wiki_passwd\n";
+        }
+        if ($cre_protocol ne "") {
+                $msg .= "protocol=$cre_protocol\n";
+        }
+        if ($cre_host ne "") {
+                $msg .= "host=$cre_host\n";
+        }
+        if ($cre_path ne "") {
+                $msg .= "path=$cre_path\n";
+        }
+
+        $msg .= "\n";
+
+	my $key;
+	my $value;
+	my $Prog = "git credential $op";
+	open2(*Reader, *Writer, $Prog);
+	print Writer $msg;
+	close (Writer);
+
+	if ($op eq "fill") {
+		while (<Reader>) {
+			my ($key, $value) = /([^=]*)=(.*)/;
+			# error if key undef
+			if (not defined $key) {
+				print STDERR "ERROR reciving reponse git credential fill\n";
+				exit 1;
+			}
+			if ($key eq "username") {
+				$wiki_login = $value;
+			}
+			if ($key eq "password") {
+				$wiki_passwd = $value;
+			}
+		}
+	} else {
+		while (<Reader>) {
+			print STDERR "\nERROR while running git credential $op:\n$_";
+		}
+	}
+}
+
 my $mediawiki;
 
+sub ask_login {
+	run_credential("fill","store");
+
+	if (!$mediawiki->login( {
+		lgname => $wiki_login,
+		lgpassword => $wiki_passwd,
+		lgdomain => $wiki_domain,
+		} )) {
+			print STDERR "Failed to log in mediawiki user \"$wiki_login\" on $url\n";
+			print STDERR "URL:$wiki_domain $url\n";
+			print STDERR "(error " .
+			    $mediawiki->{error}->{code} . ': ' .
+			    $mediawiki->{error}->{details} . ")\n";
+			run_credential("reject");
+	#		exit 1;
+	} else {
+		print STDERR "Logged in with user \"$wiki_login\".\n";
+		run_credential("approve");
+	}
+}
+
 sub mw_connect_maybe {
+
 	if ($mediawiki) {
 	    return;
 	}
 	$mediawiki = MediaWiki::API->new;
 	$mediawiki->{config}->{api_url} = "$url/api.php";
 	if ($wiki_login) {
-		if (!$mediawiki->login({
-			lgname => $wiki_login,
-			lgpassword => $wiki_passwd,
-			lgdomain => $wiki_domain,
-		})) {
-			print STDERR "Failed to log in mediawiki user \"$wiki_login\" on $url\n";
-			print STDERR "(error " .
-			    $mediawiki->{error}->{code} . ': ' .
-			    $mediawiki->{error}->{details} . ")\n";
-			exit 1;
-		} else {
-			print STDERR "Logged in with user \"$wiki_login\".\n";
+		if (!$wiki_passwd) {
+			#user knows, password not.
+			ask_login();
 		}
+	} else 	{
+		#user or password not knows
+		ask_login();
 	}
 }
 

-- 
1.7.11.rc2.9.ge2c5c96.dirty

On Sat, Jun 09, 2012 at 08:53:48PM +0200, Javier.Roucher-Iglesias@ensimag.imag.fr wrote:

Is there any reason not to add this to perl/Git.pm? I suspect that other
scripts will want to use it, too (for example, send-email could probably
use it for SMTP credentials).

+	if (scalar(@_) == 2) {
+		if ($_[1] eq ("store" || "cache")) {
+			run_git("config credential.helper \'$_[1]\'");
+		} else {
+			print STDERR "ERROR: run_credential (fill|approve|reject) [store|cache]\n";
+			exit 1;
+		}
+	}

This hunk looks wrong. You should never be setting the credential.helper
config; that is the responsibility of the user to set, as they want to
select whatever helper is appropriate. Nor do you need to care about
which helpers are in use; the point of git-credential is that it will do
that for you.

+	my $parsed = URI->new($url);
+	$cre_protocol = $parsed->scheme;
+	$cre_host = $parsed->host;
+	$cre_path = $parsed->path;
+
+        if ($wiki_login ne "") {
+                $msg .= "username=$wiki_login\n";
+        }
+        if ($wiki_passwd ne "") {
+                $msg .= "password=$wiki_passwd\n";
+        }
+        if ($cre_protocol ne "") {
+                $msg .= "protocol=$cre_protocol\n";
+        }
+        if ($cre_host ne "") {
+                $msg .= "host=$cre_host\n";
+        }
+        if ($cre_path ne "") {
+                $msg .= "path=$cre_path\n";
+        }
+
+        $msg .= "\n";

All of this could just go away for the "fill" case if we allow URLs on
the command line (see my previous email if you haven't already). And for
the "approve" and "reject" cases, we could just save the result from
"fill" and feed it back verbatim, as I described in the earlier email.

Then it would be as simple as:

  sub fill_credential {
          my $quoted_url = quotemeta(shift);

          my $verbatim = `git credential fill $quoted_url`;
          $? and die "git-credential failed";

          $verbatim =~ /^username=(.*)$/m
                  or die "git-credential did not give us a username";
          my $username = $1;
          $verbatim =~ /^password=(.*)$/m
                  or die "git-credential did not give us a password";

          return ($username, $password, $verbatim);
  }

  sub report_credential {
          my ($type, $verbatim) = @_;
          open(my $fh, '|-', "git credential $type");
          print $fh $verbatim;
  }

+	my $key;
+	my $value;
+	my $Prog = "git credential $op";
+	open2(*Reader, *Writer, $Prog);
+	print Writer $msg;
+	close (Writer);
+
+	if ($op eq "fill") {
+		while (<Reader>) {
+			my ($key, $value) = /([^=]*)=(.*)/;
+			# error if key undef
+			if (not defined $key) {
+				print STDERR "ERROR reciving reponse git credential fill\n";
+				exit 1;
+			}
+			if ($key eq "username") {
+				$wiki_login = $value;
+			}
+			if ($key eq "password") {
+				$wiki_passwd = $value;
+			}
+		}
+	} else {
+		while (<Reader>) {
+			print STDERR "\nERROR while running git credential $op:\n$_";
+		}
+	}
+}

This isn't a good way to check for errors. The non-fill actions will
never produce output on stdout, and you are not intercepting their
stderr. Besides which, checking for errors by reading stderr is not a
good practice; you should check the return value of the command in $?
after it finishes.

-Peff