You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@subversion.apache.org by cm...@apache.org on 2010/09/14 15:11:50 UTC
svn commit: r996884 - in /subversion/trunk/subversion/mod_dav_svn: authz.c
dav_svn.h liveprops.c lock.c repos.c
Author: cmpilato
Date: Tue Sep 14 13:11:49 2010
New Revision: 996884
URL: http://svn.apache.org/viewvc?rev=996884&view=rev
Log:
Hide unreadable directory children in mod_dav_svn's GET response.
Subversion has always publicly disclaimed that certain aspects of the
system will leak the name of unreadable files or subdirectories, but
not their contents. But when its easy to keep that information out of
view, we might as well do so.
* subversion/mod_dav_svn/dav_svn.h,
* subversion/mod_dav_svn/authz.c
(dav_svn__allow_read_resource): Was dav_svn__allow_read(). Fix the
docstring. Callers updated to track the new function name.
(dav_svn__allow_read): Was authz.c:allow_read(). Fix the docstring.
Callers updated to track the new function name.
* subversion/mod_dav_svn/repos.c
(deliver): Check for read permission on the dirents of versioned
directories returned for display in HTML or XML, hiding those for
which the user has no read permission.
* subversion/mod_dav_svn/lock.c,
* subversion/mod_dav_svn/liveprops.c
Updated calls to renamed functions.
Modified:
subversion/trunk/subversion/mod_dav_svn/authz.c
subversion/trunk/subversion/mod_dav_svn/dav_svn.h
subversion/trunk/subversion/mod_dav_svn/liveprops.c
subversion/trunk/subversion/mod_dav_svn/lock.c
subversion/trunk/subversion/mod_dav_svn/repos.c
Modified: subversion/trunk/subversion/mod_dav_svn/authz.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/authz.c?rev=996884&r1=996883&r2=996884&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_dav_svn/authz.c (original)
+++ subversion/trunk/subversion/mod_dav_svn/authz.c Tue Sep 14 13:11:49 2010
@@ -32,17 +32,12 @@
#include "dav_svn.h"
-/* Convert incoming REV and PATH from request R into a version-resource URI
- for REPOS and perform a GET subrequest on it. This will invoke any authz
- modules loaded into apache. Return TRUE if the subrequest succeeds, FALSE
- otherwise. If REV is SVN_INVALID_REVNUM, then we look at HEAD.
-*/
-static svn_boolean_t
-allow_read(request_rec *r,
- const dav_svn_repos *repos,
- const char *path,
- svn_revnum_t rev,
- apr_pool_t *pool)
+svn_boolean_t
+dav_svn__allow_read(request_rec *r,
+ const dav_svn_repos *repos,
+ const char *path,
+ svn_revnum_t rev,
+ apr_pool_t *pool)
{
const char *uri;
request_rec *subreq;
@@ -176,7 +171,7 @@ authz_read(svn_boolean_t *allowed,
}
/* We have a (rev, path) pair to check authorization on. */
- *allowed = allow_read(arb->r, arb->repos, revpath, rev, pool);
+ *allowed = dav_svn__allow_read(arb->r, arb->repos, revpath, rev, pool);
return SVN_NO_ERROR;
}
@@ -195,10 +190,10 @@ dav_svn__authz_read_func(dav_svn__authz_
svn_boolean_t
-dav_svn__allow_read(const dav_resource *resource,
- svn_revnum_t rev,
- apr_pool_t *pool)
+dav_svn__allow_read_resource(const dav_resource *resource,
+ svn_revnum_t rev,
+ apr_pool_t *pool)
{
- return allow_read(resource->info->r, resource->info->repos,
- resource->info->repos_path, rev, pool);
+ return dav_svn__allow_read(resource->info->r, resource->info->repos,
+ resource->info->repos_path, rev, pool);
}
Modified: subversion/trunk/subversion/mod_dav_svn/dav_svn.h
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/dav_svn.h?rev=996884&r1=996883&r2=996884&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_dav_svn/dav_svn.h (original)
+++ subversion/trunk/subversion/mod_dav_svn/dav_svn.h Tue Sep 14 13:11:49 2010
@@ -672,17 +672,32 @@ typedef struct
} dav_svn__authz_read_baton;
-/* Convert incoming RESOURCE and revision REV into a version-resource URI and
- perform a GET subrequest on it. This will invoke any authz modules loaded
- into apache. Return TRUE if the subrequest succeeds, FALSE otherwise.
+/* Return TRUE iff the current user (as determined by Apache's
+ authentication system) has permission to read PATH in REPOS at REV
+ (where an invalid REV means "HEAD"). This will invoke any authz
+ modules loaded into Apache unless this Subversion location has been
+ configured to bypass those in favor of a direct lookup in the
+ Subversion authz subsystem. Use POOL for any temporary allocation.
+*/
+svn_boolean_t
+dav_svn__allow_read(request_rec *r,
+ const dav_svn_repos *repos,
+ const char *path,
+ svn_revnum_t rev,
+ apr_pool_t *pool);
- If REV is SVN_INVALID_REVNUM, then we look at HEAD.
- Use POOL for any temporary allocation.
+/* Return TRUE iff the current user (as determined by Apache's
+ authentication system) has permission to read RESOURCE in REV
+ (where an invalid REV means "HEAD"). This will invoke any authz
+ modules loaded into Apache unless this Subversion location has been
+ configured to bypass those in favor of a direct lookup in the
+ Subversion authz subsystem. Use POOL for any temporary allocation.
*/
svn_boolean_t
-dav_svn__allow_read(const dav_resource *resource,
- svn_revnum_t rev,
- apr_pool_t *pool);
+dav_svn__allow_read_resource(const dav_resource *resource,
+ svn_revnum_t rev,
+ apr_pool_t *pool);
+
/* If authz is enabled in the specified BATON, return a read authorization
function. Otherwise, return NULL. */
Modified: subversion/trunk/subversion/mod_dav_svn/liveprops.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/liveprops.c?rev=996884&r1=996883&r2=996884&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_dav_svn/liveprops.c (original)
+++ subversion/trunk/subversion/mod_dav_svn/liveprops.c Tue Sep 14 13:11:49 2010
@@ -144,7 +144,7 @@ get_path_revprop(svn_string_t **propval,
{
*propval = NULL;
- if (! dav_svn__allow_read(resource, committed_rev, pool))
+ if (! dav_svn__allow_read_resource(resource, committed_rev, pool))
return SVN_NO_ERROR;
/* Get the property of the created revision. The authz is already
Modified: subversion/trunk/subversion/mod_dav_svn/lock.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/lock.c?rev=996884&r1=996883&r2=996884&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_dav_svn/lock.c (original)
+++ subversion/trunk/subversion/mod_dav_svn/lock.c Tue Sep 14 13:11:49 2010
@@ -458,7 +458,8 @@ get_locks(dav_lockdb *lockdb,
/* If the resource's fs path is unreadable, we don't want to say
anything about locks attached to it.*/
- if (! dav_svn__allow_read(resource, SVN_INVALID_REVNUM, resource->pool))
+ if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
+ resource->pool))
return dav_new_error(resource->pool, HTTP_FORBIDDEN,
DAV_ERR_LOCK_SAVE_LOCK,
"Path is not accessible.");
@@ -518,7 +519,8 @@ find_lock(dav_lockdb *lockdb,
/* If the resource's fs path is unreadable, we don't want to say
anything about locks attached to it.*/
- if (! dav_svn__allow_read(resource, SVN_INVALID_REVNUM, resource->pool))
+ if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
+ resource->pool))
return dav_new_error(resource->pool, HTTP_FORBIDDEN,
DAV_ERR_LOCK_SAVE_LOCK,
"Path is not accessible.");
@@ -596,7 +598,8 @@ has_locks(dav_lockdb *lockdb, const dav_
/* If the resource's fs path is unreadable, we don't want to say
anything about locks attached to it.*/
- if (! dav_svn__allow_read(resource, SVN_INVALID_REVNUM, resource->pool))
+ if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
+ resource->pool))
return dav_new_error(resource->pool, HTTP_FORBIDDEN,
DAV_ERR_LOCK_SAVE_LOCK,
"Path is not accessible.");
@@ -639,7 +642,8 @@ append_locks(dav_lockdb *lockdb,
/* If the resource's fs path is unreadable, we don't allow a lock to
be created on it. */
- if (! dav_svn__allow_read(resource, SVN_INVALID_REVNUM, resource->pool))
+ if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
+ resource->pool))
return dav_new_error(resource->pool, HTTP_FORBIDDEN,
DAV_ERR_LOCK_SAVE_LOCK,
"Path is not accessible.");
@@ -806,7 +810,8 @@ remove_lock(dav_lockdb *lockdb,
/* If the resource's fs path is unreadable, we don't allow a lock to
be removed from it. */
- if (! dav_svn__allow_read(resource, SVN_INVALID_REVNUM, resource->pool))
+ if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
+ resource->pool))
return dav_new_error(resource->pool, HTTP_FORBIDDEN,
DAV_ERR_LOCK_SAVE_LOCK,
"Path is not accessible.");
@@ -891,7 +896,8 @@ refresh_locks(dav_lockdb *lockdb,
/* If the resource's fs path is unreadable, we don't want to say
anything about locks attached to it.*/
- if (! dav_svn__allow_read(resource, SVN_INVALID_REVNUM, resource->pool))
+ if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
+ resource->pool))
return dav_new_error(resource->pool, HTTP_FORBIDDEN,
DAV_ERR_LOCK_SAVE_LOCK,
"Path is not accessible.");
Modified: subversion/trunk/subversion/mod_dav_svn/repos.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/mod_dav_svn/repos.c?rev=996884&r1=996883&r2=996884&view=diff
==============================================================================
--- subversion/trunk/subversion/mod_dav_svn/repos.c (original)
+++ subversion/trunk/subversion/mod_dav_svn/repos.c Tue Sep 14 13:11:49 2010
@@ -3120,6 +3120,7 @@ deliver(const dav_resource *resource, ap
apr_hash_t *entries;
apr_pool_t *entry_pool;
apr_array_header_t *sorted;
+ svn_revnum_t dir_rev = SVN_INVALID_REVNUM;
int i;
/* XML schema for the directory index if xslt_uri is set:
@@ -3197,6 +3198,7 @@ deliver(const dav_resource *resource, ap
}
else
{
+ dir_rev = svn_fs_revision_root_revision(resource->info->root.root);
serr = svn_fs_dir_entries(&entries, resource->info->root.root,
resource->info->repos_path, resource->pool);
if (serr != NULL)
@@ -3305,9 +3307,31 @@ deliver(const dav_resource *resource, ap
const char *name = item->key;
const char *href = name;
svn_boolean_t is_dir = (entry->kind == svn_node_dir);
+ const char *repos_relpath = NULL;
svn_pool_clear(entry_pool);
+ /* DIR_REV is set to a valid revision if we're looking at
+ the entries of a versioned directory. Otherwise, we're
+ looking at a parent-path listing. */
+ if (SVN_IS_VALID_REVNUM(dir_rev))
+ {
+ repos_relpath = svn_path_join(resource->info->repos_path,
+ name, entry_pool);
+ if (! dav_svn__allow_read(resource->info->r,
+ resource->info->repos,
+ repos_relpath,
+ dir_rev,
+ entry_pool))
+ continue;
+ }
+ else
+ {
+ /* ### TODO: We could test for readability of the root
+ directory of each repository and hide those that
+ the user can't see. */
+ }
+
/* append a trailing slash onto the name for directories. we NEED
this for the href portion so that the relative reference will
descend properly. for the visible portion, it is just nice. */