Support for mod_authz_svn
Kazar
The repository I run uses per-directory access controls to restrict
access to certain sections of the repository, based on usernames, and
login is forced by standard http authorization. I use mod_authz_svn
in apache to setup the groups and usernames for the various
directories in the repository. Now, the problem I encountered was
that while the listing xsl in ReposStyle obeyed the restrictions
(since it was a simply a transformation of svn generated content), the
log script did not, and if someone was in an area they had access to,
say /repo/trunk/core, and they clicked on a view history, they could
then change the target parameter to any path in the repository,
without restrictions.
I then proceeded to write some code to fix this problem and support
per-directory access for the logs, that correlates with actual
repository access, assuming per-directory controls exists. It
basically consists of reading in and parsing the appropriate
mod_authz_svn access file, getting the authenticated user from
$_SERVER['REMOTE_USER'], and checking whether, according to the read
access file, that user is allowed to view the specified target.
Was simply wondering if you would like me to contribute this code, as
I certainly found a need for it, and I expect others who use per-
directory access will to.
Staffan Olsson
>
> Hey,
>
> The repository I run uses per-directory access controls to restrict
> access to certain sections of the repository, based on usernames, and
> login is forced by standard http authorization. I use mod_authz_svn
> in apache to setup the groups and usernames for the various
> directories in the repository. Now, the problem I encountered was
> that while the listing xsl in ReposStyle obeyed the restrictions
> (since it was a simply a transformation of svn generated content), the
> log script did not, and if someone was in an area they had access to,
> say /repo/trunk/core, and they clicked on a view history, they could
> then change the target parameter to any path in the repository,
> without restrictions.
>
Yes, the current solution is only suitable if you're fine with public
visibility of paths and log messages (the actual data is of course not
accessible).
> I then proceeded to write some code to fix this problem and support
> per-directory access for the logs, that correlates with actual
> repository access, assuming per-directory controls exists. It
> basically consists of reading in and parsing the appropriate
> mod_authz_svn access file, getting the authenticated user from
> $_SERVER['REMOTE_USER'], and checking whether, according to the read
> access file, that user is allowed to view the specified target.
>
> Was simply wondering if you would like me to contribute this code, as
> I certainly found a need for it, and I expect others who use per-
> directory access will to.
Yes. Contributions are always welcome. You can post patches to this
list or ask me for write access to the svn sources.
We have used $_SERVER['REMOTE_USER'] in some applications (not Repos
Style). A problem that I know of is that browsers handle same-host
paths differently: sometimes users can login to repo/project/trunk/
and the credentials will be sent automatically at repos-web/open/log,
sometimes users have to log in again.
/Staffan
Kazar
preference, do you want all the code in log.php, or are you ok with an
include?
On Jun 16, 12:46 pm, "Staffan Olsson" <sols...@gmail.com> wrote:
Kazar
be stuck in a redirect loop
Staffan Olsson
down. I'll get back to you.
/Staffan
Staffan Olsson
On Mon, Jun 16, 2008 at 4:37 PM, Kazar <monkey...@gmail.com> wrote:
>
> Ok, it's just a seperate file with two functions in it - what's your
> preference, do you want all the code in log.php, or are you ok with an
> include?
>
Include is good.
/Staffan
Kazar
On Jun 17, 3:23 am, "Staffan Olsson" <sols...@gmail.com> wrote:
> Fixed. The start page for the open source projects is back again now.
>
>
> > Ok, it's just a seperate file with two functions in it - what's your
> > preference, do you want all the code in log.php, or are you ok with an
> > include?
>
>
> /Staffan
> On Tue, Jun 17, 2008 at 3:35 AM, Staffan Olsson <sols...@gmail.com> wrote:
> > Thanks for pointing this out. I hadn't noticed that the repository was
> > down. I'll get back to you.
>
> > /Staffan
>
Kazar
section. I've commented a fair bit, but if you've got any questions/
improvements, just drop me a line.
Alistair