Feature request: Hide restricted directories when using path-based authorization

[Shaun Pinney <sh...@bil.konicaminolta.us>]

Hello SVN devs!

When using path-based authorization to restrict users access to certain
directories, we'd like to completely hide top-level folders and their
contents.  However, clearing a user's read permission for a folder only
hides the folder's contents - the top-level folder itself is still viewable
even when read access has not been granted.  Can a feature be added to allow
top-level folders to be hidden in addition to their contents?

For example, the SVN book gives this example.

[calc:/branches/calc/bug-142]
harry = rw
sally = r

[calc:/branches/calc/bug-142/secret]
harry =

We'd like to ensure user harry cannot see /secret with an 'svn ls' or
otherwise become aware of /secret.  The current implementation seems to use
the parent folder's read permissions but I'd like a way to have the folder's
read permission to take precedence.  A svnserve.conf/httpd.conf option to
'hide folders without read-access' would be perfect.  

Please let me know if this is possible and valid.  Thanks very much for your
time!

Best,
Shaun

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&dsMessageId=2400424

Re: Feature request: Hide restricted directories when using path-based authorization

["C. Michael Pilato" <cm...@collab.net>]

Shaun Pinney wrote:
> Hello SVN devs!
> 
> When using path-based authorization to restrict users access to certain
> directories, we'd like to completely hide top-level folders and their
> contents.  However, clearing a user's read permission for a folder only
> hides the folder's contents - the top-level folder itself is still viewable
> even when read access has not been granted.

It's not so much the case that folder permissions only apply to their
contents by design.  It's just that certain Subversion subcommands leak the
names of unreadable objects.  Read the section "KNOWN LEAKAGE OF UNREADABLE
PATHS" in http://svn.collab.net/repos/svn/trunk/notes/authz_policy.txt for
more details.

-- 
C. Michael Pilato <cm...@collab.net>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand

------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&dsMessageId=2404513