FW: FW: how can I keep some user from pushing outside of his branch

Wed Dec 2 12:42:28 UTC 2015

I realize now, the commit will use the current branch
I noticed that when my collegue do its first clone, the rev is not the last one so maybe that was the issue

From: Simon King [mailto:simon at simonking.org.uk]
Sent: mercredi 2 décembre 2015 13:06
To: FLORENT Philippe
Cc: mercurial at selenic.com
Subject: Re: FW: how can I keep some user from pushing outside of his branch

Sorry, which option can't you find?

On Wed, Dec 2, 2015 at 11:59 AM, FLORENT Philippe <Philippe.FLORENT at edenred.com<mailto:Philippe.FLORENT at edenred.com>> wrote:
Sounds awesome but I cant find the option in the global nor repository settings

From: Simon King [mailto:simon at simonking.org.uk<mailto:simon at simonking.org.uk>]
Sent: mercredi 2 décembre 2015 12:54
To: FLORENT Philippe

Subject: Re: how can I keep some user from pushing outside of his branch

The note on that wiki page is confusing - it's comparing the ACL extension to something from Subversion, and I don't really understand the point it is trying to make.

Mercurial absolutely can do "partial commits" (you can select the files that are part of each commit). When you *push* changes to another repository, you can't push a partial revision, but you can choose which revisions you want to push. By default, all revisions which don't exist in the remote repository will be pushed, but you can use the "-r" switch to "hg commit" to choose which revisions to push. "hg push -r ." will just push ancestors of your current working directory (so no other branches will be pushed). TortoiseHG allows you to set that as the default push behaviour.

Simon

On Wed, Dec 2, 2015 at 11:17 AM, FLORENT Philippe <Philippe.FLORENT at edenred.com<mailto:Philippe.FLORENT at edenred.com>> wrote:
Yes but form the doc, I see that it does not allow to do partial push like on only one branch

https://www.mercurial-scm.org/wiki/AclExtension

“Mercurial can't do partial commits, nor can it limit the change list sent (which in effect means all changes across a repository must be sent in its entirety). Such limited functionality can be supplied by subrepositories<https://www.mercurial-scm.org/wiki/Subrepository>. »

And subrepositories, to my understanding, only allow to create groups

From: Simon King [mailto:simon at simonking.org.uk<mailto:simon at simonking.org.uk>]
Sent: mercredi 2 décembre 2015 11:20
To: FLORENT Philippe
Cc: mercurial at selenic.com<mailto:mercurial at selenic.com>
Subject: Re: how can I keep some user from pushing outside of his branch

You don't have to install the acl extension, it's distributed with mercurial. You just need to configure it.

You can enable it by editing the ".hg/hgrc" file in the repository on the server to add the following lines:

    [extensions]
    acl=

If you've enabled the extension locally, you can use "hg help acl" to read the documentation. (You can also use "hg --config extensions.acl= help acl" to read the docs without enabling the extension)

You ought to heed the warning near the beginning of the docs though:

"""
The acl hook is best used along with a restricted shell like hgsh, preventing
authenticating users from doing anything other than pushing or pulling. The
hook is not safe to use if users have interactive shell access, as they can
then disable the hook. Nor is it safe if remote users share an account,
because then there is no way to distinguish them.
"""

This is just enforcing the point that if your users have general shell access to the server machine, and filesystem privileges, a malicious user can bypass any restrictions you put in place.

Hope that helps,

Simon

On Wed, Dec 2, 2015 at 7:15 AM, FLORENT Philippe <Philippe.FLORENT at edenred.com<mailto:Philippe.FLORENT at edenred.com>> wrote:
No, it's just that he does not check which branch he commits to and tortoise sometimes does not commit to the last branch I don't know why, or what he did to achieve that

But the point is that I am really amaze that one can't protect a branch as an inner mercurial feature and have to install some plugin

I mean imagine the mess on github if anyone could push anything to the default repository branch

> -----Original Message-----
> From: FLORENT Philippe [mailto:Philippe.FLORENT at edenred.com<mailto:Philippe.FLORENT at edenred.com>]
> Sent: Monday, November 30, 2015 10:59 PM
> To: Becker, Mischa J
> Subject: RE: how can I keep some user from pushing outside of his
> branch
>
> I mean how do people put a rep online (server) and keep users from
> pushing on it (the default branch or some branches they created),
> there must be a way to do so

I don't have any experience with this.  Check out the acl extension that Pierre-Yves David mentioned.

> Details :
> On linux(server), I have put all users in the same group so they can
> access the rep via ssh I got a repository where I push the code on the
> default branch, but my collegue is in charge of the css/layout...
> So sometimes as my collegue does a commit on his local rep, that crap
> of tortoise, for some wicked wizardry reason, don't use his branch
> name as default (sometimes it does, on my pc I don't have this issue)
> He does not notice it, clicks ok and his changesets are added to the
> default branch instead of his and so the tree I try to keep clean is
> all messed up with no possibility of going back

I don't know how to break TortoiseHg such that what you describe can happen on accident.  TortoiseHg, same as Hg, commits to the current branch.  You have to manually select a different branch to commit to and then, when you click the Commit button, you have to confirm that you want to create a new branch named "xxx" or that your are restarting the branch named "xxx".

When your colleague's commit ends up on the default branch, is the parent commit also on the default branch?  If the problem is that he isn't aware of which branch he is on when he commits, he should rearrange his Log so the Branch column is front and center. (View -> Choose Log Columns...) On my log, the first 3 columns are Graph, Rev, & Branch.

If TortoiseHg really is broken, you'll get better help on their email list.  Not everybody on this list uses thg.  https://lists.sourceforge.net/lists/listinfo/tortoisehg-discuss

Mischa

> Also, even if I set this up on linux server, how do I set this up on
> his local repository
>
> thanks
>
>
>> -----Original Message-----
>> From: Becker, Mischa J [mailto:mischa.becker at kroger.com<mailto:mischa.becker at kroger.com>]
>> Sent: lundi 30 novembre 2015 23:04
>> To: FLORENT Philippe; mercurial at selenic.com<mailto:mercurial at selenic.com>
>> Subject: RE: how can I keep some user from pushing outside of his
>> branch
>>
>> From: FLORENT Philippe
>> Sent: Friday, November 27, 2015 6:12 AM
>> Subject: how can I keep some user from pushing outside of his branch
>>
>> Hello,
>>
>> My colleague keeps pushing to the default branch (cos tortoisehg is
>> an annoying piece of crap) and as mercurial does not allow to go back
>> so it's all a bloody mess everytime
>>
>> Is there a way (.hgrc??) to keep if from pushing to the default branch?
>>
>> thanks
>>
>> If you don't want TortoiseHg to push all changes by default, go into
>> settings, select Sync on left and set the Default Push to Branch or
>> Revision.  This defaults the push to changes on the current branch or
>> changes on the current branch up to the current revision.
>>
>> This won't prevent the push from ever happening but should reduce
>> accidents.
>>
>> Mischa

________________________________

This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain information that is confidential and protected by law from unauthorized disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.
_______________________________________________
Mercurial mailing list
Mercurial at selenic.com<mailto:Mercurial at selenic.com>
https://selenic.com/mailman/listinfo/mercurial

_______________________________________________
Mercurial mailing list
Mercurial at selenic.com<mailto:Mercurial at selenic.com>
https://selenic.com/mailman/listinfo/mercurial

_______________________________________________
Mercurial mailing list
Mercurial at selenic.com<mailto:Mercurial at selenic.com>
https://selenic.com/mailman/listinfo/mercurial

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mercurial-scm.org/pipermail/mercurial/attachments/20151202/33776f8c/attachment-0002.html>