Re: [viewvc-dev] How to secure ViewVC access ?
"Yves Martin" <[email protected]>
| Newsgroups | gmane.comp.version-control.cvs.viewcvs.devel |
|---|---|
| Message-ID | <1189167198.7585.148.camel__16114.6377832212$1189167228$gmane$org@pcyma> |
On Tue, 2007-09-04 at 09:50 -0400, C. Michael Pilato wrote:
> See the root_as_url_component option in viewvc.conf. Toggling that option
> to a non-zero value will cause ViewVC to generate URLs exactly as you
> recommended. This will facilitate using Location blocks to do per-repos
> auth protection.
Thanks. I really feal guilty not having looked at the configuration
file ;)
> As for blocking the repository listing, you could just edit lib/viewvc.py,
> and tweak the function view_roots() to throw an exception:
>
> def view_roots(request):
> + raise debug.ViewVCException('Access denied', '501 Not Authorized')
> data = common_template_data(request)
> request.server.header()
> generate_page(request, "roots", data)
I'm relunctant to change a script.
Do you think it is enough to use a "Deny from all" for
"/cgi-bin/viewvc.cgi" with is another block to all each root ?
> But the root listing also appears in a drop-down box in the template set, so
> you'll also want to tweak templates/include/header.ezt so that it no longer
> thinks there are any roots to list:
>
> ...
> <body>
> <div class="vc_navheader">
> +[define roots][end]
> [if-any roots]
> <form method="get" action="[change_root_action]">
> [end]
> ...
Perfect.
Thank you for your quick help
Best regards
--
Yves Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]