Re: [viewvc-dev] ViewVC 1.1 enabling "default_file_view = co" seems to override svnauthz

Phil Pinkerton wrote:
> authorizer = svnauthz is set to use the svn.access file and this was
> working until ...
> 
> I changed "default_file_view = log"  to  "default_file_view = co" and
> "allowed_views = markup, annotate" to "allowed_views = markup,
> annotate, co"
> 
> Now anyone can view the repositories again as if svnauthz was not enabled ?
> 
> Does this mean I cannot allow &view=co AND use svnauthz ??
> 
> I would like to allow &view=co to those who are in the svn.access list
> BUT NOT EVERYONE ELSE.
> 
> any ideas ??

[Sorry for missing this, Phil.  For some reason your mail was marked "read" 
in my Inbox.]

The authz logic was designed to work universally across ViewVC.  So,  if 
this is really the case, that the checkout/download view bypasses the authz 
logic, then this scenario is called SECURITY BUG!  We'll want to get to the 
bottom of this and fix said bug before ViewVC 1.1 is released, of course.

-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIiMVJokEGqRcG/W4RAiWdAJ97nCub2mavdHxTCjvhuSJKIZssiwCgogej
ID478SXoikJyeHbenGe+KvI=
=GL7/
-----END PGP SIGNATURE-----