Re: [viewvc-dev] viewvc-1.1.0-beta1 issue with svnauthz and username case

Filed issue #419:  http://viewvc.tigris.org/issues/show_bug.cgi?id=419

C. Michael Pilato wrote:
> Update: Subversion does, in fact, do case-sensitive comparisons.  However,
> there is (as of Subversion 1.6) an httpd.conf directive to force all
> incoming usernames to be normalized into upper- or lower-cased form.  The
> right thing to do here is for ViewVC to grow support for an option that does
> this kind of case transformation, too.
> 
> I'll file an issue to track this.
> 
> C. Michael Pilato wrote:
>> Eliott, thanks for the report.
>>
>> I'd like to match Subversion's own authz functionality to the degree
>> possible.  I'm trying to recall whether it honors the case in usernames --
>> specifically whether case-differing-only names are supported or not.  If
>> they aren't, then obviously it makes sense to just .lower() the incoming
>> username before attempting the match against the authz-file harvested
>> information.
>>
>> eliott wrote:
>>> Greetings,
>>>
>>> Version:
>>>   viewvc-1.1.0-beta1
>>>
>>>
>>> Problem description:
>>>   Our svnauthz file has usernames in Mixed_Case. The apache auth
>>> passes the case to the cgi scripts (we are running viewvc as cgi).
>>> However, the python ConfigParser by default does a 'lower' operation
>>> on the results of cp.option(). This causes our usernames to never
>>> match their permissions `as parsed` from the authz file by viewvc.
>>>
>>> This happens in def _process_access_section(section) around about line
>>> 126 at `cp.options(section)`.
>>>
>>> Possible fixes:
>>>   I had two potential workarounds, of which I am currently utilizing the first.
>>>
>>> 1. lib/vcauth/svnauthz/__init__.py line 25.
>>>     -     self.username = username
>>>     +    self.username = username.lower()
>>>
>>> This forces the passed in cgi var username to lowercase. This then
>>> matches the cp.option which is forced to lowercase by the
>>> ConfigParser.
>>>
>>> 2. override the ConfigParser optionxform with a 'monkey patch'.
>>>    lib/vcauth/svnauthz/__init__.py line 20.
>>>    + ConfigParser.optionxform = str
>>>
>>> Another alternative would be to subclass ConfigParser and override the
>>> optionxform there. That would arguably be cleaner than the monkeypatch
>>> method.
>>>
>>> I am using the first method, because monkeypatching 'feels' a bit
>>> dirty to me, I don't believe we have any case collisions with
>>> usernames, and I don't know offhand if the change for #2 would have
>>> any other efffects based on case handling in the existing code.
>>>
>>> Hope this is helpful to someone.
>>>
>>> ------------------------------------------------------
>>> http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4251&dsMessageId=1187483
>>>
>>> To unsubscribe from this discussion, e-mail: [[email protected]].
>>
> 
> 


-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4251&dsMessageId=2359791

To unsubscribe from this discussion, e-mail: [[email protected]].

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkopZG4ACgkQokEGqRcG/W7UeQCfSJYSrYKE2rPHAUehklIqn2gr
WsUAnjMR2cayPje31tp3sYpbQlD7uusS
=KLCA
-----END PGP SIGNATURE-----