I noticed that the Config page runs git commands on the fly from the webserver user.
The problem is, these commands have not any HOME environment variable.
So, these git commands cannot open any .gitconfig.
So, these git commands do not benefit from global configurations set for the webserver user.
This is a problem for example in:
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Open | None | T15090 CVE-2022-24765 - Multi-user Git Privilege Escalation | ||
| Open | None | T15282 Fix/avoid/simplify similar fatal: detected dubious ownership in repository at '/var/www/phorge' | ||
| Open | None | T15299 Config page runs git commands that should have an HOME to open gitconfig correctly | ||
| Open | None | T15281 $HOME missing from commands issued by ExecFuture | ||
| Resolved | valerio.bozzolan | T15298 Get the HOME of the user running the PHP webserver |
Lol. I don't know what we should do here. Feel free to wontfix. Probably this is the solution to an unclear issue.