[viewvc-dev] running viewvc as a setuid cgi script

Hi,


Because of my syste, configuration, I need to run viewvc as a setuid cgi
script. I created a small wrapper cgi which invokes viewvc with
effective uid != the real uid, which is apache's uid. I immediatly
encountered problem, because viewvc checks paths accessibility using the
real uid, not the effective, one, so I patched the code as follows:


--- lib/vclib/bincvs/__init__.py.~20070928091501~       2007-09-28
05:15:01.000000000 -0400
+++ lib/vclib/bincvs/__init__.py        2007-12-09 12:32:27.000000000 -0500
@@ -1026,7 +1026,7 @@
     return kind, errors
 
 else:
-  _uid = os.getuid()
+  _uid = os.geteuid()
   _gid = os.getgid()
 
   def _check_path(pathname):


It helped some, but not completely. I can view the whole CVS tree with
the revision numbers etc, and also clicking on (annotate) in the log of
each file. but, clicking on (view), gives me an exception trace, as follows:

Traceback (most recent call last):
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 3665, in main
    request.run_viewvc()
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 388, in run_viewvc
    self.view_func(self)
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 1368, in view_markup
    fp, revision = request.repos.openfile(path, rev)
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 134, in openfile
    filename, revision = _parse_co_header(fp)
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 534, in _parse_co_header
    raise COMalformedOutput, "Unable to find filename in co output stream"
COMalformedOutput: Unable to find filename in co output stream

(download) gives a a similar exception trace:


Traceback (most recent call last):
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 3665, in main
    request.run_viewvc()
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 388, in run_viewvc
    self.view_func(self)
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/viewvc.py", line 2142, in view_checkout
    fp, revision = request.repos.openfile(path, rev)
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 134, in openfile
    filename, revision = _parse_co_header(fp)
  File "/public/vhost/g/gilead/viewvc-1.0.4/lib/vclib/bincvs/__init__.py", line 534, in _parse_co_header
    raise COMalformedOutput, "Unable to find filename in co output stream"
COMalformedOutput: Unable to find filename in co output stream


Should I pursue this, or do you see inherent problems in running viewvc
as a setuid script?


Best,


Zvi

-- 
Dr. Zvi Har'El      mailto:[email protected]    Department of Mathematics
tel:+972-54-4227607                  Technion - Israel Institute of Technology
fax:+972-4-8293388  http://www.math.technion.ac.il/~rl/    Haifa 32000, ISRAEL
"If you can't say somethin' nice, don't say nothin' at all." -- Thumper (1942)

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]