Problem: TortoiseProc.exe uses wrong credentials / overwrites credentials in svn.simple with wrong data

[Philipp Mott]

Setup / Client:

Windows 8.1 Pro

TSVN 1.9.5 Build 27581

 

Setup / Server:

Windows Server 2008

VisualSVN Server 3.5.7

 

Authentication:

Simple auth.

 

Problem description:

After Login at a client machine TortoiseProc.exe overwrites previously stored credentials in %APPDATA%\Roaming\Subversion\auth\svn.simple.

The file in svn.simple concerning "VisualSVN Server"  is overwritten and points to another user. Credentials for this other user are not stored elsewhere inside SVN, neither can the username be found in the registry.

 

This behaviour suddenly occured without any changes to TSVN, VisualSVN or the repo structures.

It now occurs with every user logon to windows.
The only workaround is: User deletes credential cache manually and authenticates again.

 

 

Details:

In addition to the "real" users all repos allow read-only access to a simple user with a known password; The username is "bind".

Whenever a user logs on to windows the previously stored credential file (excerpt below) is overwritten by the credentials for "bind".
There is also an instance of TortoiseProc.exe "hanging" in the process list.

 

Replacing the credentials file with a backup version leads to the same behaviour:

TortoiseProc.exe replaces it. This is verified using procmon.

 

The "hanging" TortoiseProc.exe can be killed.

After killing the credentials file is not overwritten anymore.

Afterwards hibernating the windows machine, waking it up and logging in again does not reproduce the error, so it probably lies within the first instance of TortoiseProc.exe.

Workaround (not an acceptable solution):

- Script, startet after login:

  - kill TortoiseProc.exe

  - replace credentials file with a backup version

 

 

Excerpt from overwritten credentials file in svn.simple:

 

--snip--

K 8

passtype

V 8

wincrypt

K 8

password

V 260

AQA (…) =

K 15

svn:realmstring

V 41

<https://XXXXXXX:8443> VisualSVN Server

K 8

username

V 3

bind

END

--snap--

 

 

Even if the workaroung might be the only solution for the time being, I'd very much like to know where this problem originates.

Thanks for any help!

 

_______________________________________________________________________________________________
Giffits GmbH
Weidestrasse 122b
22083 Hamburg
GERMANY
Tel: +49 (0)40 2788201-0
Fax: +49 (0)40 2788201-79
www.giffits.de

Sitz der Gesellschaft: Hamburg
Geschäftsführer: Thorsten Schmidt, Marcus Schulz
Handelsregister HRB 106954, Amtsgericht Hamburg Steuernummer 43/724/00701
Umsatzsteuer ID Nr. DE262054425
WEEE-REG.Nr. DE68758991

Diese E-Mail und alle beigefügten Dateien sind vertraulich und nur für den Adressaten bestimmt.
Wenn Sie nicht der richtige Adressat sind, leiten Sie diese E-Mail bitte nicht weiter, öffnen Sie etwaige Anhänge nicht,
machen Sie keine Kopien und speichern Sie diese E-Mail nicht. Informieren Sie uns bitte, indem Sie uns eine Antwort-Mail
senden oder uns telefonisch unter +49 (0402788201-0)verständigen. Löschen Sie bitte anschließend die erhaltene E-Mail aus Ihrem System.
Vielen Dank!

This email is only intended for the addressee. The content of this email, including all attachments is confidential and includes privileged material.
If you are not the intended recipient, please do not forward or disclose this email, do not open any attachments or make copies or save this email anywhere.
Please inform us about the error by returning this email or by calling us on our phone +49 (0)40 2788201-0. Please then finally delete this email from your system.
Thank you very much.

[Gavin Lambert]

On 2/02/2017 02:23, Philipp Mott wrote:
> After Login at a client machine TortoiseProc.exe overwrites previously
> stored credentials in %APPDATA%\Roaming\Subversion\auth\svn.simple.

[...]

> In addition to the "real" users all repos allow read-only access to a
> simple user with a known password; The username is "bind".
>
> Whenever a user logs on to windows the previously stored credential file
> (excerpt below) is overwritten by the credentials for "bind".
> There is also an instance of TortoiseProc.exe "hanging" in the process list.

This sounds like you have a login script or Run entry or similar at the
site which is trying to run TortoiseProc with those credentials.

Obviously TSVN itself can't possibly know about a user called "bind", so
it must be something site-specific.

TortoiseProc is a GUI program and should never be used from login
scripts or similar non-interactive environments; use the svn
command-line client in those contexts instead.

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=3209149

To unsubscribe from this discussion, e-mail: [users-un...@tortoisesvn.tigris.org].