Re: svn diff with differing permissions

(Sending this message to the dev list as well as users, because it
involves a bug report that developers would be interested in.)

Jim Paris wrote:
> I am using authz on a 1.2.0 server.  My authz file contains something
> like
> 
>   [/]
>   * = 
>   jim = rw
> 
>   [/aaa]
>   * = r
>   jim = rw
> 
> (ie, /aaa is world-readable, but nothing else is).  The command
> 
>   svn diff https://jim.sh/svn/jim/aaa/ https://jim.sh/svn/jim/bbb/
> 
> fails with error
> 
>   svn: REPORT request failed on '/svn/jim/!svn/vcc/default'
>   svn: Not authorized to open root of edit operation
> 
> and Apache reports:
> 
>   A failure occurred while driving the update report editor  [500, #220000]
>   Not authorized to open root of edit operation  [500, #220000]
> 
> Switching the arguments so that the one that requires authentication
> comes first:
> 
>   svn diff https://jim.sh/svn/jim/bbb/ https://jim.sh/svn/jim/aaa/
> 
> works correctly.  Both "svn diff" commands ask for my password exactly
> once.  Is this a bug?

This seems similar to an 'svn log' issue that has been noted on the dev
list (they're not quite the same though):

http://svn.haxx.se/dev/archive-2005-08/0286.shtml

... see Ben Collins-Sussman's response to that message for an
explanation of what's going on in the case of 'svn log'.  Basically,
Apache does not ask for authentication because the target of the log
request does not require authorization.

In the case of 'svn diff', it appears that maybe the server only checks
if it needs authentication for the first URL given?  If that's the case,
that clearly seems like unintended behavior, though I don't know how
easy it would be to fix.

-- 
Michael W Thelen
It is a mistake to think you can solve any major problems just with
potatoes.       -- Douglas Adams