Subversion authz pitfall

Using SVNPath and SVNParentPath together with AuthzSVNAccessFile has to be configured slightly different:

<location /projects/bob>
DAV svn
SVNPath /var/svn/public/projects/bob
AuthzSVNAccessFile /home/bob/svnaccess.conf
</location>

versus
<location /projects/>
DAV svn
SVNParentPath /var/svn/public/projects
AuthzSVNAccessFile /home/bob/svnaccess.conf
</location>

Note the trailing slash in the location block in the second example.
If there was a trailing slash in the first example, dav_svn would not work at all (SSL error).

Now let's mix both things:
<location /projects>
DAV svn
SVNParentPath /var/svn/public/projects
</location>

<location /projects/bob>
AuthzSVNAccessFile /home/bob/svnaccess.conf
</location>

Here dav_svn will work, but authz will not work as expected.
The problem is that authz is defined "later", i.e. one path level deeper than DAV svn. Subversion's authz does in my opinion not correctly determine the actual repository in this case. It sees /projects/bob ("bob" is the repository name) as the parent path and treats subdirectories of "bob" as repository names.

Restricting access to subdirectories of "bob" would now be done in the following way:
[subdir:/]
someone = r

While the following which should be how it's done will not work:

[bob:/subdir]
someone = r

I am using the following Subversion and Apache versions:
Apache/2.0.54 (Debian GNU/Linux) DAV/2 SVN/1.3.2

Comments: Post a Comment

<< Home

This page is powered by Blogger. Isn't yours?