[viewvc-users] Security Issue/Bug with TAR view ?

Jean-Yves Avenard <[email protected]>
Newsgroups gmane.comp.version-control.cvs.viewcvs.user
Message-ID <9638792.3864.1263035131963.JavaMail.httpd__8964.16827240518$1263067904$gmane$org@localhost>
Hi there...

Hi there... Not sure if this is intended or not, but it appears to be a security risk/bug to me...

I have a ViewVC installation, which works very well.
The SVN repository can be accessed by around 30 different users ; they all have different access rights ; and can browse some directories, and not others.

The permissions are defined with Apache using:
<Location /wsvn/projects>
   AuthType Basic
   AuthName "Subversion Projects Repository"
   SVNPath /pool/data/svn/projects
   AuthzSVNAccessFile /usr/local/etc/apache22/svn-auth-file
   AuthBasicProvider    hydrixldap
   Require valid-users
</Location>

This works well. People can only see what they have access to ; and get a 403 error otherwise.

However, if the "TAR" view is enabled ; and you download a directory, all sub-directories will be included in the archive ; included those that the users have no read/write access to.

Is there something I'm missing ? surely this is not the intended behaviour.

Thank you
Jean-Yves

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2435922

To unsubscribe from this discussion, e-mail: [[email protected]].
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.