.

blob.go

@@ -14,6 +14,7 @@ import (
 	"log"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"regexp"
 	"strings"
 	"sync"
@@ -220,17 +221,25 @@ var rawRe = regexp.MustCompile(`/raw/`)
 func handleGetBlobRaw(w http.ResponseWriter, r *gitRequest) {
 	// Extract project & refpath
 	// <project>/raw/branch/file -> <project>, branch/file
-	url := r.Request.URL
-	rawLoc := rawRe.FindStringIndex(url.Path)
+	u := r.Request.URL // XXX naming
+	rawLoc := rawRe.FindStringIndex(u.Path)
 	if rawLoc == nil {
 		fail500(w, "extract project name", nil) // XXX err=nil
 		return
 	}
-	project := url.Path[:rawLoc[0]]
-	refpath := url.Path[rawLoc[1]:]
+	project := u.Path[:rawLoc[0]]
+	refpath := u.Path[rawLoc[1]:]
+
+	// Extract only tokens from query
+	query := url.Values{}
+	for k, v := range u.Query() {
+		if strings.HasSuffix(k, "_token") {
+			query[k] = v
+		}
+	}
 
 	// Query download access auth for this project
-	authReply := verifyDownloadAccess(r.u, project, url.RawQuery)
+	authReply := verifyDownloadAccess(r.u, project, query.Encode())
 	if authReply.RepoPath == "" {
 		// access denied - copy auth reply to client in full -
 		// there are HTTP code and other headers / body relevant for