Make sure http-git is readonly

diff --git a/conf/nginx/git4ai b/conf/nginx/git4ai
index b045aac70f08553fd5d5357d3bbf83521337b258..a0b8284009dc12990bfc2773bdc666d510d09b16 100644 (file)
--- a/conf/nginx/git4ai
+++ b/conf/nginx/git4ai
@@ -115,6 +115,10 @@ location ~ "^/git4ai[^/]*/([a-zA-Z0-9._-]+)/([a-zA-Z0-9._-]+|-)/([0-9a-f]{4,40}|
 }
 
   location ~ ^/git(/.*) {
+       # Read only repo
+       limit_except GET HEAD {
+               deny all;
+       }
         fastcgi_pass unix:/var/run/fcgiwrap.socket;
         fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
         fastcgi_param GIT_PROJECT_ROOT /var/lib/git;