From: Nikolay Shaplov <dhyan@nataraj.su>
Date: Sun, 7 Jun 2026 18:43:30 +0000 (+0000)
Subject: Make sure http-git is readonly
X-Git-Url: http://gitweb.nataraj.world/?a=commitdiff_plain;h=b89731aabbe92141ebba81270012337a6714e15f;p=git4ai.git

Make sure http-git is readonly
---

diff --git a/conf/nginx/git4ai b/conf/nginx/git4ai
index b045aac..a0b8284 100644
--- a/conf/nginx/git4ai
+++ b/conf/nginx/git4ai
@@ -115,6 +115,10 @@ location ~ "^/git4ai[^/]*/([a-zA-Z0-9._-]+)/([a-zA-Z0-9._-]+|-)/([0-9a-f]{4,40}|
 }
 
   location ~ ^/git(/.*) {
+	# Read only repo
+	limit_except GET HEAD {
+		deny all;
+	}
         fastcgi_pass unix:/var/run/fcgiwrap.socket;
         fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
         fastcgi_param GIT_PROJECT_ROOT /var/lib/git;