Re: [viewvc-users] Security Issue/Bug with TAR view ?
"C. Michael Pilato" <[email protected]>
| Newsgroups | gmane.comp.version-control.cvs.viewcvs.user |
|---|---|
| Organization | CollabNet, Inc. |
| Message-ID | <[email protected]> |
Jean-Yves Avenard wrote: > Hi there... > > Hi there... Not sure if this is intended or not, but it appears to be a security risk/bug to me... > > I have a ViewVC installation, which works very well. > The SVN repository can be accessed by around 30 different users ; they all have different access rights ; and can browse some directories, and not others. > > The permissions are defined with Apache using: > <Location /wsvn/projects> > AuthType Basic > AuthName "Subversion Projects Repository" > SVNPath /pool/data/svn/projects > AuthzSVNAccessFile /usr/local/etc/apache22/svn-auth-file > AuthBasicProvider hydrixldap > Require valid-users > </Location> > > This works well. People can only see what they have access to ; and get a 403 error otherwise. > > However, if the "TAR" view is enabled ; and you download a directory, all sub-directories will be included in the archive ; included those that the users have no read/write access to. > > Is there something I'm missing ? surely this is not the intended behaviour. Did you configure ViewVC to honor your Subversion authz configuration? If not, ViewVC has no way to know what directories it should and shouldn't show to your users. -- C. Michael Pilato <[email protected]> CollabNet <> www.collab.net <> Distributed Development On Demand ------------------------------------------------------ http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2435980 To unsubscribe from this discussion, e-mail: [[email protected]].