Re: [viewvc-users] .htaccess

[email protected] wrote:
> I see.  My confusion stems from your FAQ Answer to Question:
> "Does ViewVC support path-based authorization, such as Subversion's
> authz-file mechanism?"
>
> Where you say:
>
> "If you prefer to use only final releases, there are some available
> workarounds. For example, if you are running ViewVC under Apache, you can
> use regular Apache configuration directives to authz-protect areas of your
> repository — see the Location and LocationMatch directives, as well as the
> Authentication, Authorization and Access Control portions of the Apache
> HTTP Server documentation."
> and provide a link [http://httpd.apache.org/docs/2.2/howto/auth.html]
> directly to a page that describes how to set up .htaccess.
>
> I'm not an expert in apache mods, but from your answer it appears to me
> the statement "you can use regular Apache configuration directives to
> authz-protect areas of your repository" is incorrect.  If my understanding
> is wrong could you please elaborate?

[looks both ways, then slips out the back door]

Ahem.  Yes, that FAQ item could stand to be more clear and set expectations
better.

You can use Apache directives such <Location> blocks with authz/authn
sections to restrict ViewVC URLs at a very high level.  For example, say you
have your ViewVC exposed on your server at http://server/viewvc.  If you
have roots_as_url_components=1, then your repositories will appear at
http://server/viewvc/root1, http://server/viewvc/root2, etc.  You can put in
httpd.conf something like:

   <Location /viewvc/root1>
     # some authn and authz requirements
   </Location>

and in doing so, require users visiting URLs that start with /viewvc/root1
to meet some criteria.  You can even extend this into the paths inside that
repository:

   <Location /viewvc/root1/my-project/secret-directory>
     # some authn and authz requirements
   </Location>

This will work to a degree, but you really have to configure ViewVC
precisely at the cost of some functionality to really block access to paths
using this approach.  You're asking Apache to lay authorization atop an
application that doesn't go out of its way to make such overlays possible or
easy.

Also, as I mentioned before, ViewVC provides a layer of abstraction between
the CVS repository directory/files on your server and the web server, so
.htaccess files dropped into that repository appear not as Apache
configuration overrides, but as malformed versioned CVS files.  So .htaccess
is fine up to the point where Apache defers to ViewVC to generate output --
IIRC, you can .htaccess in the viewvc/bin/cgi/ directory, for example, to
configure who can and can't access ViewVC at all.  But once you grant access
to ViewVC to the user, .htaccess is out of the picture.

I strongly recommend that folks switch to ViewVC 1.1.x and enable the
svnauthz authorization module.  Yes, it was written to read/understand
Subversion's stock authorization configuration files, but ViewVC is happy to
apply the rules there to CVS repositories, too, if you wish.

-- 
C. Michael Pilato <[email protected]>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://viewvc.tigris.org/ds/viewMessage.do?dsForumId=4255&dsMessageId=2593589

To unsubscribe from this discussion, e-mail: [[email protected]].

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkvRtmQACgkQokEGqRcG/W4D6wCgyZzivYJq5oZRq+OHIJUGFtQt
CIcAn08BirglzQoDAaOxYJjuFUX8Xnon
=nk1K
-----END PGP SIGNATURE-----