Re: [viewvc-dev] ViewVC 1.1 enabling "default_file_view = co" seems to override svnauthz

I did  a test by removing myself from the admin list which has all access 
to see if I can still have access to everything and I still do even though 
I am not on any repo in the access list ??

Just weird I am not associated with any access in svn.access ( our access 
file ) but I can view everything from ViewVC

I did the same test on our beta box  it has an older nightly release of 
ViewVC 1.1 and it works as expected ? 
I am blocked from everything, and the &view=co is enabled, so its working 
properly.

The only other thing I changed on the production ViewVC  1.1 was I removed 
the -dev from the footer. ( i.e Powered by VC 1.1)

The Beta ViewVC is however a few days older than the production nightly 
build unfortunately the tar files were removed and the source directory 
names where changed to ViewVC_1.1


Phil Pinkerton
TEK-Systems Consultant
SCM - NWIE Team

" The fundamental principle here is that the justification for a physical 
concept lies exclusively in its clear an unambiguous relation to the facts 
it can be experienced" 
AE





"C. Michael Pilato" <[email protected]>
 




07/24/2008 03:32 PM

From
"C. Michael Pilato" <[email protected]>
To
Phil Pinkerton <[email protected]>
cc
[email protected]
Subject
Re: [viewvc-dev]         ViewVC 1.1 enabling "default_file_view = co" 
seems to override svnauthz






Phil Pinkerton wrote:
> authorizer = svnauthz is set to use the svn.access file and this was
> working until ...
>
> I changed "default_file_view = log"  to  "default_file_view = co" and
> "allowed_views = markup, annotate" to "allowed_views = markup,
> annotate, co"
>
> Now anyone can view the repositories again as if svnauthz was not 
enabled ?

Hrm.  I don't see how changing the allowed and default values would 
matter.
The authz logic is triggered down in the depths of the version control
abstraction library -- a level of logic that knows nothing of ViewVC's
configuration, the requested view of the file, etc.

Further, I can't seem to demonstrate this problem on my own machine.  I
typically run with allowed_views=markup,annotate,co,tar and
default_file_view=co, and my unprivileged users are denied access just as 
I
would expect them to be.

--
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand




Attachment(s) have been removed by Philip Pinkerton
signature.asc