Re: [viewvc-dev] viewvc-1.1.0-beta1 issue with svnauthz and username case

Update: Subversion does, in fact, do case-sensitive comparisons.  However,
there is (as of Subversion 1.6) an httpd.conf directive to force all
incoming usernames to be normalized into upper- or lower-cased form.  The
right thing to do here is for ViewVC to grow support for an option that does
this kind of case transformation, too.

I'll file an issue to track this.

C. Michael Pilato wrote:
> Eliott, thanks for the report.
> 
> I'd like to match Subversion's own authz functionality to the degree
> possible.  I'm trying to recall whether it honors the case in usernames --
> specifically whether case-differing-only names are supported or not.  If
> they aren't, then obviously it makes sense to just .lower() the incoming
> username before attempting the match against the authz-file harvested
> information.
> 
> eliott wrote:
>> Greetings,
>>
>> Version:
>>   viewvc-1.1.0-beta1
>>
>>
>> Problem description:
>>   Our svnauthz file has usernames in Mixed_Case. The apache auth
>> passes the case to the cgi scripts (we are running viewvc as cgi).
>> However, the python ConfigParser by default does a 'lower' operation
>> on the results of cp.option(). This causes our usernames to never
>> match their permissions `as parsed` from the authz file by viewvc.
>>
>> This happens in def _process_access_section(section) around about line
>> 126 at `cp.options(section)`.
>>
>> Possible fixes:
>>   I had two potential workarounds, of which I am currently utilizing the first.
>>
>> 1. lib/vcauth/svnauthz/__init__.py line 25.
>>     -     self.username = username
>>     +    self.username = username.lower()
>>
>> This forces the passed in cgi var username to lowercase. This then
>> matches the cp.option which is forced to lowercase by the
>> ConfigParser.
>>
>> 2. override the ConfigParser optionxform with a 'monkey patch'.
>>    lib/vcauth/svnauthz/__init__.py line 20.
>>    + ConfigParser.optionxform = str
>>
>> Another alternative would be to subclass ConfigParser and override the
>> optionxform there. That would arguably be cleaner than the monkeypatch
>> method.
>>
>> I am using the first method, because monkeypatching 'feels' a bit
>> dirty to me, I don't believe we have any case collisions with
>> usernames, and I don't know offhand if the change for #2 would have
>> any other efffects based on case handling in the existing code.
>>
>> Hope this is helpful to someone.
>>
>> ------------------------------------------------------
>> http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4251&dsMessageId=1187483
>>
>> To unsubscribe from this discussion, e-mail: [[email protected]].
> 
> 


-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4251&dsMessageId=2359789

To unsubscribe from this discussion, e-mail: [[email protected]].

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkopY2EACgkQokEGqRcG/W77vQCeOwFPCYbzeaSSMvIzlUAr0yog
7qAAnAhOItWkfLmyC/DIAxEDk9L/aJlj
=tQFR
-----END PGP SIGNATURE-----