Question

I am setting up a mercurial server on my shared hosting account with bluehost. I do have ssh access but do not have access to the apache config. Basically the mercurial server runs off one single cgi script, in my case domain.com/repos/hg.cgi (for access to all repositories on the server). I have protected the “repos” directory using a .htaccess file and an auth file.

But the way mercurial works, that for example the repository “stack” is accessed like this:
domain.com/repos/hg.cgi/stack

This poses a problem, since authentication happened in the repos directory, and all users that have access to that now have access to all the repositories.

Is there a way to protect the individual repositories using just a .htaccess file?

Answer 1

Within each repository’s .hg/hgrc file you can list users that can and can’t access it:

[web]
allow_read = you,yourfriend
allow_push = you