Re: [viewvc-dev] viewvc-1.1.0-beta1 issue with svnauthz and username case

Ahem.  In the time between I first read your request and I filed this issue,
it seems I completely misremembered the problem.  Sorry about that.  My
head's on straight now.

C. Michael Pilato wrote:
> Filed issue #419:  http://viewvc.tigris.org/issues/show_bug.cgi?id=419
> 
> C. Michael Pilato wrote:
>> Update: Subversion does, in fact, do case-sensitive comparisons.  However,
>> there is (as of Subversion 1.6) an httpd.conf directive to force all
>> incoming usernames to be normalized into upper- or lower-cased form.  The
>> right thing to do here is for ViewVC to grow support for an option that does
>> this kind of case transformation, too.
>>
>> I'll file an issue to track this.
>>
>> C. Michael Pilato wrote:
>>> Eliott, thanks for the report.
>>>
>>> I'd like to match Subversion's own authz functionality to the degree
>>> possible.  I'm trying to recall whether it honors the case in usernames --
>>> specifically whether case-differing-only names are supported or not.  If
>>> they aren't, then obviously it makes sense to just .lower() the incoming
>>> username before attempting the match against the authz-file harvested
>>> information.
>>>
>>> eliott wrote:
>>>> Greetings,
>>>>
>>>> Version:
>>>>   viewvc-1.1.0-beta1
>>>>
>>>>
>>>> Problem description:
>>>>   Our svnauthz file has usernames in Mixed_Case. The apache auth
>>>> passes the case to the cgi scripts (we are running viewvc as cgi).
>>>> However, the python ConfigParser by default does a 'lower' operation
>>>> on the results of cp.option(). This causes our usernames to never
>>>> match their permissions `as parsed` from the authz file by viewvc.
>>>>
>>>> This happens in def _process_access_section(section) around about line
>>>> 126 at `cp.options(section)`.
>>>>
>>>> Possible fixes:
>>>>   I had two potential workarounds, of which I am currently utilizing the first.
>>>>
>>>> 1. lib/vcauth/svnauthz/__init__.py line 25.
>>>>     -     self.username = username
>>>>     +    self.username = username.lower()
>>>>
>>>> This forces the passed in cgi var username to lowercase. This then
>>>> matches the cp.option which is forced to lowercase by the
>>>> ConfigParser.
>>>>
>>>> 2. override the ConfigParser optionxform with a 'monkey patch'.
>>>>    lib/vcauth/svnauthz/__init__.py line 20.
>>>>    + ConfigParser.optionxform = str
>>>>
>>>> Another alternative would be to subclass ConfigParser and override the
>>>> optionxform there. That would arguably be cleaner than the monkeypatch
>>>> method.
>>>>
>>>> I am using the first method, because monkeypatching 'feels' a bit
>>>> dirty to me, I don't believe we have any case collisions with
>>>> usernames, and I don't know offhand if the change for #2 would have
>>>> any other efffects based on case handling in the existing code.
>>>>
>>>> Hope this is helpful to someone.
>>>>
>>>> ------------------------------------------------------
>>>> http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4251&dsMessageId=1187483
>>>>
>>>> To unsubscribe from this discussion, e-mail: [[email protected]].
>>
> 
> 


-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4251&dsMessageId=2359795

To unsubscribe from this discussion, e-mail: [[email protected]].

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkopZn0ACgkQokEGqRcG/W60OgCgjIVDB6D2BEOCsXARI42cqaAK
P/cAn1ZAT62IPOVXK46fLXmvB2H2tS51
=rvua
-----END PGP SIGNATURE-----