|
1 | | -# Apache MINA SSHD 2.19.0 |
2 | | - |
3 | | -* Changes since [version 2.18.0](./docs/changes/2.18.0.md): |
4 | | - |
5 | | -## Bug Fixes |
6 | | - |
7 | | -* [GH-899](https://github.com/apache/mina-sshd/issues/899) Fix `ProcessShellFactory` on Linux |
8 | | -* [GH-902](https://github.com/apache/mina-sshd/pull/902) Fix client-side handling of sk-* public key signatures (also in the agent interfaces) |
9 | | -* Limit size of decompressed SSH packets |
10 | | -* Improve checking SSH user certificates in public-key authentication |
11 | | -* Improve handling of repository paths in `sshd-git` on Windows |
12 | | -* Validate file names in SCP |
13 | | -* Escape newlines in filenames in the SCP protocol |
14 | | -* Restrict JGit commands accessible via `GitPgmCommandFactory` in `sshd-git` |
15 | | - |
16 | | -## New Features |
17 | | - |
18 | | -None. |
19 | | - |
20 | | -## Potential Compatibility Issues |
21 | | - |
22 | | -### Restrict JGit commands accessible via `GitPgmCommandFactory` in `sshd-git` |
23 | | - |
24 | | -Bundle `sshd-git` contains a `GitPgmCommandFactory` that can be configured for an Apache MINA SSHD server. |
25 | | -It enables remote execution of git commands via JGit. |
26 | | - |
27 | | -However, running arbitrary git commands remotely is an exotic use case, and some commands (like |
28 | | -`git archive --format zip --output somefile.zip` or also `git clone` or `git checkout`) could even create |
29 | | -files on the server. This should be only allowed in an OS-level chrooted environment, which Apache MINA |
30 | | -SSHD does not and cannot provide. |
31 | | - |
32 | | -We have therefore limited the available commands to a small set of whitelisted git commands that might |
33 | | -be useful as maintenance commands for authorized power users on a git server implemented based on `sshd-git`. |
34 | | -The command are: `archive`, `blame`, `branch`, `describe`, `diff`, `gc`, `log`, `reflog`, `show`, and `status`. |
35 | | -All these commands can be executed from an client via `git --git-dir <repo> <command> <args>`, where `<repo>` |
36 | | -is the server-side name of the git repository (its local path on the server relative to the configured |
37 | | -root), `<command>` is the command name (e.g., `archive`) and `<args>` are the command arguments. Results are |
38 | | -sent back via the command output streams (output or error streams) and are thus sent back to the client. |
39 | | -For the `archive`command, the `--output` (or `-o`) argument is ignored; the archive is always returned via |
40 | | -the command's output stream and this is also sent to the client. |
41 | | - |
42 | | -Applications that might have relied on the ability to run other JGit command remotely may no longer work. |
43 | | -Either implement your own dedicated command factory to enable accesss to certain commands, or set the |
44 | | -property `GitModuleProperties.RESTRICT_COMMANDS` to `false` on the server-side `SshServer` (for all sessions) |
45 | | -or on particular `ServerSession`s (for particular individual sessions) to re-enable access to _all_ commands |
46 | | -supported by JGit. |
47 | | - |
48 | | -## Major Code Re-factoring |
49 | | - |
50 | | -None. |
51 | | - |
52 | 1 | # Previous Versions |
53 | 2 |
|
54 | 3 | * [Version 2.1.0 to 2.2.0](./docs/changes/2.2.0.md) |
|
75 | 24 | * [Version 2.16.0 to 2.17.0](./docs/changes/2.17.0.md) |
76 | 25 | * [Version 2.17.0 to 2.17.1](./docs/changes/2.17.1.md) |
77 | 26 | * [Version 2.17.1 to 2.18.0](./docs/changes/2.18.0.md) |
| 27 | + |
| 28 | +# Latest Version |
| 29 | + |
| 30 | +* **[Version 2.18.0 to 2.19.0](./docs/changes/2.19.0.md)** |
| 31 | + |
| 32 | +# Planned for Next Version |
| 33 | + |
| 34 | +## Bug Fixes |
| 35 | + |
| 36 | + |
| 37 | +## New Features |
| 38 | + |
| 39 | + |
| 40 | +## Potential Compatibility Issues |
| 41 | + |
| 42 | + |
| 43 | +## Major Code Re-factoring |
| 44 | + |
0 commit comments