git-serve: check update hook permissions

Verify that the update hook exists and is executable before running Git
to prevent from broken repositories when permissions are broken.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

1 files changed, 3 insertions, 0 deletions

diff --git a/aurweb/git/serve.py b/aurweb/git/serve.py
index 28827804..d43523c2 100755
--- a/aurweb/git/serve.py
+++ b/aurweb/git/serve.py
@@ -496,6 +496,9 @@ def serve(action, cmdargv, user, privileged, remote_addr):
             if not privileged and not pkgbase_has_write_access(pkgbase, user):
                 raise aurweb.exceptions.PermissionDeniedException(user)
 
+        if not os.access(git_update_cmd, os.R_OK | os.X_OK):
+            raise aurweb.exceptions.BrokenUpdateHookException(git_update_cmd)
+
         os.environ["AUR_USER"] = user
         os.environ["AUR_PKGBASE"] = pkgbase
         os.environ["GIT_NAMESPACE"] = pkgbase