From f9454cc32c94780eb4c49753fc0ccd9b60b1deb7 Mon Sep 17 00:00:00 2001
From: Peter Smit <peter@smitmail.eu>
Date: Mon, 16 Feb 2015 12:00:06 +0200
Subject: [PATCH] Make sure that a mirror can't be written to by http or ssh

---
 cmd/serve.go         | 5 +++++
 routers/repo/http.go | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/cmd/serve.go b/cmd/serve.go
index e8e5c186c728..9e34b95c5a45 100644
--- a/cmd/serve.go
+++ b/cmd/serve.go
@@ -164,6 +164,11 @@ func runServ(c *cli.Context) {
 			println("You have no right to write this repository")
 			log.GitLogger.Fatal(2, "User %s has no right to write repository %s", user.Name, repoPath)
 		}
+
+		if repo.IsMirror {
+			println("You can't write to a mirror repository")
+			log.GitLogger.Fatal(2, "User %s tried to write to a mirror repository %s", user.Name, repoPath)
+		}
 	case isRead:
 		if !repo.IsPrivate {
 			break
diff --git a/routers/repo/http.go b/routers/repo/http.go
index 034b5a7b5e7c..d47d73ef051d 100644
--- a/routers/repo/http.go
+++ b/routers/repo/http.go
@@ -158,6 +158,11 @@ func Http(ctx *middleware.Context) {
 					return
 				}
 			}
+
+			if !isPull && repo.IsMirror {
+				ctx.Handle(401, "can't push to mirror", nil)
+				return
+			}
 		}
 	}