RE: Bug? -SVNSYNC - Path-based authentication is ignored

Hi Daniel,

thank you very much. After adding “SVNPathAuthz on“ the sync behaves as expected. I’ll try to figure out if there is some kind of inheritance involved which might have disabled it.

BR





[PTSports_Logo_ICE2023_blue.jpg]        Tomas Molnar | System Administrator
Tel: +43158103508303 | Mobile: +436648128247 | www.playtech.com<https://www.playtech.com>


[PlaytechSports_Sig_2023_final.png]


Sensitivity: Internal


Sensitivity: Internal

From: Daniel Sahlberg <[email protected]>
Sent: Freitag, 15. März 2024 16:27
To: Tomas Molnar <[email protected]>
Cc: [email protected]
Subject: Re: Bug? -SVNSYNC - Path-based authentication is ignored

Den fre 15 mars 2024 kl 12:58 skrev Tomas Molnar via users <[email protected]<mailto:[email protected]>>:
Hi,

I’m trying to run a SVNSYNC to mirror repository via http(s). Although, I’ve allowed access to only “Folder” within the repository via AuthzSVNAccessFile the whole repository is being synchronized. The path-based authentication works perfectly for browsing the repo, but it is ignored during the sync.

When I check the Apache logs it becomes clear to me why this might be the case – Svnsync request are handled via “/svn/replication-repo/!svn/rev/<revision>”. This would basically allow to get a copy of the SVN repo and even access to locations not intended to be accessed.

version 1.13.0 (r1867053)

mod_dav.conf

<Location /svn/replication-repo>
   DAV svn
   SVNPath /…/repo
   SVNPathAuthz off

I think this is your problem. The SVN book [1] says:

The SVNPathAuthz directive is “on” by default. When set to “off,” all path-based authorization checking is disabled; mod_dav_svn stops invoking authorization checks on every path it discovers.

Can you check with this set to on (or disabled altogether)?

Kind regards,
Daniel

[1] https://svnbook.red-bean.com/nightly/en/svn.serverconfig.httpd.html#svn.serverconfig.httpd.authz.pathauthzoff

   AuthType Basic
   AuthName "Authorization SVN"
   AuthBasicProvider file
   AuthzSVNAccessFile /…/authz
   AuthUserFile /…/users
   require valid-user
</Location>


AuthzSVNAccessFile:

[groups]
roFilteredGroup = ReplicationFiltered

[replication-repo:/]
@roFilteredGroup =

[replication-repo:/Folder]
@roFilteredGroup = r



Sensitivity: Internal


[PTSports_Logo_ICE2023_blue.jpg]
Tomas Molnar | System Administrator
Tel: +43158103508303 | Mobile: +436648128247 | www.playtech.com<https://www.playtech.com>


[PlaytechSports_Sig_2023_final.png]


Sensitivity: Internal