[viewvc-users] Security Issue/Bug with TAR view ?
Jean-Yves Avenard <[email protected]>
| Newsgroups | gmane.comp.version-control.cvs.viewcvs.user |
|---|---|
| Message-ID | <9638792.3864.1263035131963.JavaMail.httpd__8964.16827240518$1263067904$gmane$org@localhost> |
Hi there... Hi there... Not sure if this is intended or not, but it appears to be a security risk/bug to me... I have a ViewVC installation, which works very well. The SVN repository can be accessed by around 30 different users ; they all have different access rights ; and can browse some directories, and not others. The permissions are defined with Apache using: <Location /wsvn/projects> AuthType Basic AuthName "Subversion Projects Repository" SVNPath /pool/data/svn/projects AuthzSVNAccessFile /usr/local/etc/apache22/svn-auth-file AuthBasicProvider hydrixldap Require valid-users </Location> This works well. People can only see what they have access to ; and get a 403 error otherwise. However, if the "TAR" view is enabled ; and you download a directory, all sub-directories will be included in the archive ; included those that the users have no read/write access to. Is there something I'm missing ? surely this is not the intended behaviour. Thank you Jean-Yves ------------------------------------------------------ http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2435922 To unsubscribe from this discussion, e-mail: [[email protected]].