Do not leak repo existence information too early

main.go

@@ -74,13 +74,6 @@ func git_handler(w http.ResponseWriter, r *http.Request) {
 	for _, g := range git_services {
 		path_match := g.regexp.FindStringSubmatch(r.URL.Path)
 		if r.Method == g.method && path_match != nil {
-			// Validate the path to the Git repository
-			found_path := path_match[1]
-			if !valid_path(found_path) {
-				http.Error(w, "Not found", 404)
-				return
-			}
-
 			// Ask the auth backend if the request is allowed, and what the
 			// user ID (GL_ID) is.
 			auth_response, err := do_auth_request(r)
@@ -110,6 +103,13 @@ func git_handler(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 
+			// Validate the path to the Git repository
+			found_path := path_match[1]
+			if !valid_path(found_path) {
+				http.Error(w, "Not found", 404)
+				return
+			}
+
 			g.handle_func(user, g.rpc, path.Join(repo_root, found_path), w, r)
 			return
 		}