You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@subversion.apache.org by br...@apache.org on 2015/07/27 02:23:41 UTC
svn commit: r1692801 [5/7] - in /subversion/branches: 1.7.x/ 1.7.x/build/
1.7.x/build/ac-macros/ 1.7.x/subversion/libsvn_repos/
1.7.x/subversion/mod_authz_svn/ 1.7.x/subversion/tests/cmdline/
1.7.x/subversion/tests/cmdline/svntest/ 1.7.x/subversion/tes...
Modified: subversion/branches/1.8.x/win-tests.py
URL: http://svn.apache.org/viewvc/subversion/branches/1.8.x/win-tests.py?rev=1692801&r1=1692800&r2=1692801&view=diff
==============================================================================
--- subversion/branches/1.8.x/win-tests.py (original)
+++ subversion/branches/1.8.x/win-tests.py Mon Jul 27 00:23:40 2015
@@ -481,6 +481,7 @@ class Httpd:
self.httpd_config = os.path.join(self.root, 'httpd.conf')
self.httpd_users = os.path.join(self.root, 'users')
self.httpd_mime_types = os.path.join(self.root, 'mime.types')
+ self.httpd_groups = os.path.join(self.root, 'groups')
self.abs_builddir = abs_builddir
self.abs_objdir = abs_objdir
self.service_name = 'svn-test-httpd-' + str(httpd_port)
@@ -494,6 +495,7 @@ class Httpd:
create_target_dir(self.root_dir)
self._create_users_file()
+ self._create_groups_file()
self._create_mime_types_file()
self._create_dontdothat_file()
@@ -540,6 +542,8 @@ class Httpd:
if self.httpd_ver >= 2.2:
fp.write(self._sys_module('auth_basic_module', 'mod_auth_basic.so'))
fp.write(self._sys_module('authn_file_module', 'mod_authn_file.so'))
+ fp.write(self._sys_module('authz_groupfile_module', 'mod_authz_groupfile.so'))
+ fp.write(self._sys_module('authz_host_module', 'mod_authz_host.so'))
else:
fp.write(self._sys_module('auth_module', 'mod_auth.so'))
fp.write(self._sys_module('alias_module', 'mod_alias.so'))
@@ -562,6 +566,7 @@ class Httpd:
# Define two locations for repositories
fp.write(self._svn_repo('repositories'))
fp.write(self._svn_repo('local_tmp'))
+ fp.write(self._svn_authz_repo())
# And two redirects for the redirect tests
fp.write('RedirectMatch permanent ^/svn-test-work/repositories/'
@@ -592,6 +597,17 @@ class Httpd:
'jrandom', 'rayjandom'])
os.spawnv(os.P_WAIT, htpasswd, ['htpasswd.exe', '-bp', self.httpd_users,
'jconstant', 'rayjandom'])
+ os.spawnv(os.P_WAIT, htpasswd, ['htpasswd.exe', '-bp', self.httpd_users,
+ 'JRANDOM', 'rayjandom'])
+ os.spawnv(os.P_WAIT, htpasswd, ['htpasswd.exe', '-bp', self.httpd_users,
+ 'JCONSTANT', 'rayjandom'])
+
+ def _create_groups_file(self):
+ "Create groups for mod_authz_svn tests"
+ fp = open(self.httpd_groups, 'w')
+ fp.write('random: jrandom\n')
+ fp.write('constant: jconstant\n')
+ fp.close()
def _create_mime_types_file(self):
"Create empty mime.types file"
@@ -652,6 +668,153 @@ class Httpd:
' DontDoThatConfigFile ' + self._quote(self.dontdothat_file) + '\n' \
'</Location>\n'
+ def _svn_authz_repo(self):
+ local_tmp = os.path.join(self.abs_builddir,
+ CMDLINE_TEST_SCRIPT_NATIVE_PATH,
+ 'svn-test-work', 'local_tmp')
+ return \
+ '<Location /authz-test-work/anon>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' <IfModule mod_authz_core.c>' + '\n' \
+ ' Require all granted' + '\n' \
+ ' </IfModule>' + '\n' \
+ ' <IfModule !mod_authz_core.c>' + '\n' \
+ ' Allow from all' + '\n' \
+ ' </IfModule>' + '\n' \
+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/mixed>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' Require valid-user' + '\n' \
+ ' Satisfy Any' + '\n' \
+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/mixed-noauthwhenanon>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' Require valid-user' + '\n' \
+ ' AuthzSVNNoAuthWhenAnonymousAllowed On' + '\n' \
+ ' SVNPathAuthz On' + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/authn>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' Require valid-user' + '\n' \
+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/authn-anonoff>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' Require valid-user' + '\n' \
+ ' AuthzSVNAnonymous Off' + '\n' \
+ ' SVNPathAuthz On' + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/authn-lcuser>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' Require valid-user' + '\n' \
+ ' AuthzForceUsernameCase Lower' + '\n' \
+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/authn-lcuser>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' Require valid-user' + '\n' \
+ ' AuthzForceUsernameCase Lower' + '\n' \
+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/authn-group>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' AuthGroupFile ' + self._quote(self.httpd_groups) + '\n' \
+ ' Require group random' + '\n' \
+ ' AuthzSVNAuthoritative Off' + '\n' \
+ ' SVNPathAuthz On' + '\n' \
+ '</Location>' + '\n' \
+ '<IfModule mod_authz_core.c>' + '\n' \
+ '<Location /authz-test-work/sallrany>' + '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' AuthzSendForbiddenOnFailure On' + '\n' \
+ ' Satisfy All' + '\n' \
+ ' <RequireAny>' + '\n' \
+ ' Require valid-user' + '\n' \
+ ' Require expr req(\'ALLOW\') == \'1\'' + '\n' \
+ ' </RequireAny>' + '\n' \
+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
+ '</Location>' + '\n' \
+ '<Location /authz-test-work/sallrall>'+ '\n' \
+ ' DAV svn' + '\n' \
+ ' SVNParentPath ' + local_tmp + '\n' \
+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
+ ' SVNListParentPath On' + '\n' \
+ ' AuthType Basic' + '\n' \
+ ' AuthName "Subversion Repository"' + '\n' \
+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
+ ' AuthzSendForbiddenOnFailure On' + '\n' \
+ ' Satisfy All' + '\n' \
+ ' <RequireAll>' + '\n' \
+ ' Require valid-user' + '\n' \
+ ' Require expr req(\'ALLOW\') == \'1\'' + '\n' \
+ ' </RequireAll>' + '\n' \
+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
+ '</Location>' + '\n' \
+ '</IfModule>' + '\n' \
+
def start(self):
if self.service:
self._start_service()
@@ -786,6 +949,10 @@ if not test_javahl:
log_file = os.path.join(abs_builddir, log)
fail_log_file = os.path.join(abs_builddir, faillog)
+ if run_httpd:
+ httpd_version = "%.1f" % daemon.httpd_ver
+ else:
+ httpd_version = None
th = run_tests.TestHarness(abs_srcdir, abs_builddir,
log_file,
fail_log_file,
@@ -795,6 +962,7 @@ if not test_javahl:
fsfs_sharding, fsfs_packing,
list_tests, svn_bin, mode_filter,
milestone_filter,
+ httpd_version=httpd_version,
set_log_level=log_level, ssl_cert=ssl_cert)
old_cwd = os.getcwd()
try:
Propchange: subversion/branches/1.9.x/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Mon Jul 27 00:23:40 2015
@@ -93,4 +93,4 @@
/subversion/branches/verify-at-commit:1462039-1462408
/subversion/branches/verify-keep-going:1439280-1546110
/subversion/branches/wc-collate-path:1402685-1480384
-/subversion/trunk:1660545-1660547,1660549-1662901,1663003,1663183-1663184,1663338,1663347,1663355,1663374,1663450,1663530,1663671,1663697,1663706,1663738,1663749,1663791,1663991,1664035,1664078,1664080,1664084-1664085,1664187,1664191,1664193,1664200,1664344,1664476,1664480-1664481,1664483,1664489-1664490,1664507,1664520-1664521,1664523,1664526-1664527,1664531-1664532,1664588,1664593-1664594,1664596,1664653,1664664,1664672,1664674,1664684,1664927,1664938-1664940,1664978,1664984,1664997,1665164,1665195,1665213,1665259,1665318,1665437-1665438,1665609,1665611-1665612,1665845,1665850,1665852,1665886,1665894,1665896,1666096,1666258,1666270,1666272,1666379,1666449,1666690,1666832,1666851,1666965,1667101,1667106-1667107,1667120,1667228,1667233-1667235,1667249-1667250,1667258,1667290,1667301,1667471,1667691-1667693,1667699-1667700,1667715,1667941,1667976,1668320,1668598-1668600,1668602-1668603,1668607-1668608,1668618,1669743,1669746,1669749,1669945,1670139,1670149,1670152,1670329,1670337,167
0347,1670353,1671164,1671388,1672295,1672311,1672372,1672404,1672511-1672512,1672578,1672728,1673044,1673062-1673063,1673065,1673153,1673170,1673172,1673197,1673202,1673204,1673228,1673282,1673445,1673691-1673692,1673746,1673785,1673803,1674015,1674032,1674170,1674301,1674305,1674308,1674339-1674340,1674406,1674415,1674455-1674456,1674475,1674487,1674522,1674580,1674627,1674891,1675771,1675774,1676526,1676535,1676538,1676555,1676564,1676570,1676665,1676667,1676769,1677003,1677191,1677267,1677440,1678147,1678149,1678494,1678571,1678734,1678742,1678745-1678746,1678839,1678846,1678894,1678950,1678963,1679166,1679169,1679228,1679230,1679287,1679864,1679866,1679909,1680242,1680264,1680495,1680705,1680819,1681317,1682714,1682854,1683071,1683126,1683135,1683290,1683303,1683311,1683378,1683387,1684034,1684077,1684322,1684325,1684344,1684412,1684940,1685034,1685085,1686175,1686239,1686478,1686541,1686543,1686554,1686557,1686802,1686888,1686984,1687029,1687769,1687776,1688258,1688273,1688395,
1689214,1689216,1689721,1689729,1691712-1691713,1691924,1692091,1692093,1692098,1692448,1692469-1692470
+/subversion/trunk:1660545-1660547,1660549-1662901,1663003,1663183-1663184,1663338,1663347,1663355,1663374,1663450,1663530,1663671,1663697,1663706,1663738,1663749,1663791,1663991,1664035,1664078,1664080,1664084-1664085,1664187,1664191,1664193,1664200,1664344,1664476,1664480-1664481,1664483,1664489-1664490,1664507,1664520-1664521,1664523,1664526-1664527,1664531-1664532,1664588,1664593-1664594,1664596,1664653,1664664,1664672,1664674,1664684,1664927,1664938-1664940,1664978,1664984,1664997,1665164,1665195,1665213,1665259,1665318,1665437-1665438,1665609,1665611-1665612,1665845,1665850,1665852,1665886,1665894,1665896,1666096,1666258,1666270,1666272,1666379,1666449,1666690,1666832,1666851,1666965,1667101,1667106-1667107,1667120,1667228,1667233-1667235,1667249-1667250,1667258,1667290,1667301,1667471,1667691-1667693,1667699-1667700,1667715,1667941,1667976,1668320,1668598-1668600,1668602-1668603,1668607-1668608,1668618,1669743,1669746,1669749,1669945,1670139,1670149,1670152,1670329,1670337,167
0347,1670353,1671164,1671388,1672295,1672311,1672372,1672404,1672511-1672512,1672578,1672728,1673044,1673062-1673063,1673065,1673153,1673170,1673172,1673197,1673202,1673204,1673228,1673282,1673445,1673691-1673692,1673746,1673785,1673803,1674015,1674032,1674170,1674301,1674305,1674308,1674339-1674340,1674406,1674415,1674455-1674456,1674475,1674487,1674522,1674580,1674627,1674891,1675771,1675774,1676526,1676535,1676538,1676555,1676564,1676570,1676665,1676667,1676769,1677003,1677191,1677267,1677440,1678147,1678149,1678494,1678571,1678734,1678742,1678745-1678746,1678839,1678846,1678894,1678950,1678963,1679166,1679169,1679228,1679230,1679287,1679864,1679866,1679909,1680242,1680264,1680495,1680705,1680819,1681317,1682714,1682854,1683071,1683126,1683135,1683290,1683303,1683311,1683378,1683387,1684034,1684077,1684322,1684325,1684344,1684412,1684940,1685034,1685085,1686175,1686239,1686478,1686541,1686543,1686554,1686557,1686802,1686888,1686984,1687029,1687769,1687776,1688258,1688273,1688395,
1689214,1689216,1689721,1689729,1691712-1691713,1691924,1692091,1692093,1692098,1692448,1692469-1692470,1692798-1692799
Modified: subversion/branches/1.9.x/build/ac-macros/apache.m4
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/build/ac-macros/apache.m4?rev=1692801&r1=1692800&r2=1692801&view=diff
==============================================================================
--- subversion/branches/1.9.x/build/ac-macros/apache.m4 (original)
+++ subversion/branches/1.9.x/build/ac-macros/apache.m4 Mon Jul 27 00:23:40 2015
@@ -167,6 +167,15 @@ if test -n "$APXS" && test "$APXS" != "n
HTTPD="`$APXS -q bindir`/`$APXS -q PROGNAME`"
fi
HTTPD_VERSION=["`$HTTPD -v | $SED -e 's@^.*/\([0-9.]*\)\(.*$\)@\1@ ; 1q'`"]
+ AC_ARG_ENABLE(broken-httpd-auth,
+ AS_HELP_STRING([--enable-broken-httpd-auth],
+ [Allow building against httpd 2.4 with broken auth]),
+ [broken_httpd_auth=$enableval],[broken_httpd_auth=no])
+ if test "$enable_broken_httpd_auth" = "yes"; then
+ AC_MSG_NOTICE([Building with broken httpd auth])
+ AC_DEFINE(SVN_ALLOW_BROKEN_HTTPD_AUTH, 1,
+ [Defined to allow building against httpd 2.4 with broken auth])
+ fi
case $host in
*-*-cygwin*)
Modified: subversion/branches/1.9.x/subversion/libsvn_repos/rev_hunt.c
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/subversion/libsvn_repos/rev_hunt.c?rev=1692801&r1=1692800&r2=1692801&view=diff
==============================================================================
--- subversion/branches/1.9.x/subversion/libsvn_repos/rev_hunt.c (original)
+++ subversion/branches/1.9.x/subversion/libsvn_repos/rev_hunt.c Mon Jul 27 00:23:40 2015
@@ -711,23 +711,6 @@ svn_repos_trace_node_locations(svn_fs_t
if (! prev_path)
break;
- if (authz_read_func)
- {
- svn_boolean_t readable;
- svn_fs_root_t *tmp_root;
-
- SVN_ERR(svn_fs_revision_root(&tmp_root, fs, revision, currpool));
- SVN_ERR(authz_read_func(&readable, tmp_root, path,
- authz_read_baton, currpool));
- if (! readable)
- {
- svn_pool_destroy(lastpool);
- svn_pool_destroy(currpool);
-
- return SVN_NO_ERROR;
- }
- }
-
/* Assign the current path to all younger revisions until we reach
the copy target rev. */
while ((revision_ptr < revision_ptr_end)
@@ -750,6 +733,20 @@ svn_repos_trace_node_locations(svn_fs_t
path = prev_path;
revision = prev_rev;
+ if (authz_read_func)
+ {
+ svn_boolean_t readable;
+ SVN_ERR(svn_fs_revision_root(&root, fs, revision, currpool));
+ SVN_ERR(authz_read_func(&readable, root, path,
+ authz_read_baton, currpool));
+ if (!readable)
+ {
+ svn_pool_destroy(lastpool);
+ svn_pool_destroy(currpool);
+ return SVN_NO_ERROR;
+ }
+ }
+
/* Clear last pool and switch. */
svn_pool_clear(lastpool);
tmppool = lastpool;
Modified: subversion/branches/1.9.x/subversion/mod_authz_svn/mod_authz_svn.c
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/subversion/mod_authz_svn/mod_authz_svn.c?rev=1692801&r1=1692800&r2=1692801&view=diff
==============================================================================
--- subversion/branches/1.9.x/subversion/mod_authz_svn/mod_authz_svn.c (original)
+++ subversion/branches/1.9.x/subversion/mod_authz_svn/mod_authz_svn.c Mon Jul 27 00:23:40 2015
@@ -48,6 +48,23 @@
#include "svn_dirent_uri.h"
#include "private/svn_fspath.h"
+/* The apache headers define these and they conflict with our definitions. */
+#ifdef PACKAGE_BUGREPORT
+#undef PACKAGE_BUGREPORT
+#endif
+#ifdef PACKAGE_NAME
+#undef PACKAGE_NAME
+#endif
+#ifdef PACKAGE_STRING
+#undef PACKAGE_STRING
+#endif
+#ifdef PACKAGE_TARNAME
+#undef PACKAGE_TARNAME
+#endif
+#ifdef PACKAGE_VERSION
+#undef PACKAGE_VERSION
+#endif
+#include "svn_private_config.h"
#ifdef APLOG_USE_MODULE
APLOG_USE_MODULE(authz_svn);
@@ -67,6 +84,30 @@ typedef struct authz_svn_config_rec {
const char *force_username_case;
} authz_svn_config_rec;
+#if AP_MODULE_MAGIC_AT_LEAST(20060110,0) /* version where
+ ap_some_auth_required breaks */
+# if AP_MODULE_MAGIC_AT_LEAST(20120211,47) /* first version with
+ force_authn hook and
+ ap_some_authn_required() which
+ allows us to work without
+ ap_some_auth_required() */
+# define USE_FORCE_AUTHN 1
+# define IN_SOME_AUTHN_NOTE "authz_svn-in-some-authn"
+# define FORCE_AUTHN_NOTE "authz_svn-force-authn"
+# else
+ /* ap_some_auth_required() is busted and no viable alternative exists */
+# ifndef SVN_ALLOW_BROKEN_HTTPD_AUTH
+# error This version of httpd has a security hole with mod_authz_svn
+# else
+ /* user wants to build anyway */
+# define USE_FORCE_AUTHN 0
+# endif
+# endif
+#else
+ /* old enough that ap_some_auth_required() still works */
+# define USE_FORCE_AUTHN 0
+#endif
+
/*
* Configuration
*/
@@ -832,6 +873,48 @@ access_checker(request_rec *r)
const char *dest_repos_path = NULL;
int status, authn_required;
+#if USE_FORCE_AUTHN
+ /* Use the force_authn() hook available in 2.4.x to work securely
+ * given that ap_some_auth_required() is no longer functional for our
+ * purposes in 2.4.x.
+ */
+ int authn_configured;
+
+ /* We are not configured to run */
+ if (!conf->anonymous || apr_table_get(r->notes, IN_SOME_AUTHN_NOTE)
+ || (! (conf->access_file || conf->repo_relative_access_file)))
+ return DECLINED;
+
+ /* Authentication is configured */
+ authn_configured = ap_auth_type(r) != NULL;
+ if (authn_configured)
+ {
+ /* If the user is trying to authenticate, let him. It doesn't
+ * make much sense to grant anonymous access but deny authenticated
+ * users access, even though you can do that with '$anon' in the
+ * access file.
+ */
+ if (apr_table_get(r->headers_in,
+ (PROXYREQ_PROXY == r->proxyreq)
+ ? "Proxy-Authorization" : "Authorization"))
+ {
+ /* Set the note to force authn regardless of what access_checker_ex
+ hook requires */
+ apr_table_setn(r->notes, FORCE_AUTHN_NOTE, (const char*)1);
+
+ /* provide the proper return so the access_checker hook doesn't
+ * prevent the code from continuing on to the other auth hooks */
+ if (ap_satisfies(r) != SATISFY_ANY)
+ return OK;
+ else
+ return HTTP_FORBIDDEN;
+ }
+ }
+
+#else
+ /* Support for older versions of httpd that have a working
+ * ap_some_auth_required() */
+
/* We are not configured to run */
if (!conf->anonymous
|| (! (conf->access_file || conf->repo_relative_access_file)))
@@ -846,9 +929,10 @@ access_checker(request_rec *r)
if (ap_satisfies(r) != SATISFY_ANY)
return DECLINED;
- /* If the user is trying to authenticate, let him. If anonymous
- * access is allowed, so is authenticated access, by definition
- * of the meaning of '*' in the access file.
+ /* If the user is trying to authenticate, let him. It doesn't
+ * make much sense to grant anonymous access but deny authenticated
+ * users access, even though you can do that with '$anon' in the
+ * access file.
*/
if (apr_table_get(r->headers_in,
(PROXYREQ_PROXY == r->proxyreq)
@@ -860,6 +944,7 @@ access_checker(request_rec *r)
return HTTP_FORBIDDEN;
}
}
+#endif
/* If anon access is allowed, return OK */
status = req_check_access(r, conf, &repos_path, &dest_repos_path);
@@ -868,7 +953,26 @@ access_checker(request_rec *r)
if (!conf->authoritative)
return DECLINED;
+#if USE_FORCE_AUTHN
+ if (authn_configured) {
+ /* We have to check to see if authn is required because if so we must
+ * return UNAUTHORIZED (401) rather than FORBIDDEN (403) since returning
+ * the 403 leaks information about what paths may exist to
+ * unauthenticated users. We must set a note here in order
+ * to use ap_some_authn_rquired() without triggering an infinite
+ * loop since the call will trigger this function to be called again. */
+ apr_table_setn(r->notes, IN_SOME_AUTHN_NOTE, (const char*)1);
+ authn_required = ap_some_authn_required(r);
+ apr_table_unset(r->notes, IN_SOME_AUTHN_NOTE);
+ if (authn_required)
+ {
+ ap_note_auth_failure(r);
+ return HTTP_UNAUTHORIZED;
+ }
+ }
+#else
if (!authn_required)
+#endif
log_access_verdict(APLOG_MARK, r, 0, FALSE, repos_path, dest_repos_path);
return HTTP_FORBIDDEN;
@@ -949,6 +1053,17 @@ auth_checker(request_rec *r)
return OK;
}
+#if USE_FORCE_AUTHN
+static int
+force_authn(request_rec *r)
+{
+ if (apr_table_get(r->notes, FORCE_AUTHN_NOTE))
+ return OK;
+
+ return DECLINED;
+}
+#endif
+
/*
* Module flesh
*/
@@ -965,6 +1080,9 @@ register_hooks(apr_pool_t *p)
* give SSLOptions +FakeBasicAuth a chance to work. */
ap_hook_check_user_id(check_user_id, mod_ssl, NULL, APR_HOOK_FIRST);
ap_hook_auth_checker(auth_checker, NULL, NULL, APR_HOOK_FIRST);
+#if USE_FORCE_AUTHN
+ ap_hook_force_authn(force_authn, NULL, NULL, APR_HOOK_FIRST);
+#endif
ap_register_provider(p,
AUTHZ_SVN__SUBREQ_BYPASS_PROV_GRP,
AUTHZ_SVN__SUBREQ_BYPASS_PROV_NAME,
Modified: subversion/branches/1.9.x/subversion/tests/cmdline/README
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/subversion/tests/cmdline/README?rev=1692801&r1=1692800&r2=1692801&view=diff
==============================================================================
--- subversion/branches/1.9.x/subversion/tests/cmdline/README (original)
+++ subversion/branches/1.9.x/subversion/tests/cmdline/README Mon Jul 27 00:23:40 2015
@@ -83,6 +83,133 @@ paths adjusted appropriately:
Require valid-user
</Location>
+ <Location /authz-test-work/anon>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ # This may seem unnecessary but granting access to everyone here is necessary
+ # to exercise a bug with httpd 2.3.x+. The "Require all granted" syntax is
+ # new to 2.3.x+ which we can detect with the mod_authz_core.c module
+ # signature. Use the "Allow from all" syntax with older versions for symmetry.
+ <IfModule mod_authz_core.c>
+ Require all granted
+ </IfModule>
+ <IfModule !mod_authz_core.c>
+ Allow from all
+ </IfMOdule>
+ </Location>
+ <Location /authz-test-work/mixed>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ Require valid-user
+ Satisfy Any
+ </Location>
+ <Location /authz-test-work/mixed-noauthwhenanon>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ Require valid-user
+ AuthzSVNNoAuthWhenAnonymousAllowed On
+ </Location>
+ <Location /authz-test-work/authn>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ Require valid-user
+ </Location>
+ <Location /authz-test-work/authn-anonoff>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ Require valid-user
+ AuthzSVNAnonymous Off
+ </Location>
+ <Location /authz-test-work/authn-lcuser>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ Require valid-user
+ AuthzForceUsernameCase Lower
+ </Location>
+ <Location /authz-test-work/authn-lcuser>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ Require valid-user
+ AuthzForceUsernameCase Lower
+ </Location>
+ <Location /authz-test-work/authn-group>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ AuthGroupFile /usr/local/apache2/conf/groups
+ Require group random
+ AuthzSVNAuthoritative Off
+ </Location>
+ <IfModule mod_authz_core.c>
+ <Location /authz-test-work/sallrany>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ AuthzSendForbiddenOnFailure On
+ Satisfy All
+ <RequireAny>
+ Require valid-user
+ Require expr req('ALLOW') == '1'
+ </RequireAny>
+ </Location>
+ <Location /authz-test-work/sallrall>
+ DAV svn
+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile /usr/local/apache2/conf/users
+ AuthzSendForbiddenOnFailure On
+ Satisfy All
+ <RequireAll>
+ Require valid-user
+ Require expr req('ALLOW') == '1'
+ </RequireAll>
+ </Location>
+ </IfModule>
+
+
RedirectMatch permanent ^/svn-test-work/repositories/REDIRECT-PERM-(.*)$ /svn-test-work/repositories/$1
RedirectMatch ^/svn-test-work/repositories/REDIRECT-TEMP-(.*)$ /svn-test-work/repositories/$1
@@ -101,6 +228,15 @@ just drop the following 2-line snippet i
----------------------------
jrandom:xCGl35kV9oWCY
jconstant:xCGl35kV9oWCY
+JRANDOM:xCGl35kV9oWCY
+JCONSTANT:xCGl35kV9oWCY
+----------------------------
+
+and these lines into the
+/usr/local/apache/conf/groups file:
+----------------------------
+random: jrandom
+constant: jconstant
----------------------------
Now, (re)start Apache and run the tests over mod_dav_svn.
@@ -138,6 +274,8 @@ Note [1]: It would be quite too much to
----------------------------
jrandom:$apr1$3p1.....$FQW6RceW5QhJ2blWDQgKn0
jconstant:$apr1$jp1.....$Usrqji1c9H6AbOxOGAzzb0
+ JRANDOM:$apr1$3p1.....$FQW6RceW5QhJ2blWDQgKn0
+ JCONSTANT:$apr1$jp1.....$Usrqji1c9H6AbOxOGAzzb0
----------------------------
Modified: subversion/branches/1.9.x/subversion/tests/cmdline/authz_tests.py
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/subversion/tests/cmdline/authz_tests.py?rev=1692801&r1=1692800&r2=1692801&view=diff
==============================================================================
--- subversion/branches/1.9.x/subversion/tests/cmdline/authz_tests.py (original)
+++ subversion/branches/1.9.x/subversion/tests/cmdline/authz_tests.py Mon Jul 27 00:23:40 2015
@@ -587,7 +587,10 @@ def authz_log_and_tracing_test(sbox):
## cat
# now see if we can look at the older version of rho
- svntest.actions.run_and_verify_svn(None, expected_err,
+
+ expected_err2 = ".*svn: E195012: Unable to find repository location.*"
+
+ svntest.actions.run_and_verify_svn(None, expected_err2,
'cat', '-r', '2', D_url+'/rho')
if sbox.repo_url.startswith('http'):
@@ -604,10 +607,11 @@ def authz_log_and_tracing_test(sbox):
svntest.actions.run_and_verify_svn(None, expected_err,
'diff', '-r', 'HEAD', G_url+'/rho')
- svntest.actions.run_and_verify_svn(None, expected_err,
+ # diff treats the unreadable path as indicating an add so no error
+ svntest.actions.run_and_verify_svn(None, [],
'diff', '-r', '2', D_url+'/rho')
- svntest.actions.run_and_verify_svn(None, expected_err,
+ svntest.actions.run_and_verify_svn(None, [],
'diff', '-r', '2:4', D_url+'/rho')
# test whether read access is correctly granted and denied
Modified: subversion/branches/1.9.x/subversion/tests/cmdline/davautocheck.sh
URL: http://svn.apache.org/viewvc/subversion/branches/1.9.x/subversion/tests/cmdline/davautocheck.sh?rev=1692801&r1=1692800&r2=1692801&view=diff
==============================================================================
--- subversion/branches/1.9.x/subversion/tests/cmdline/davautocheck.sh (original)
+++ subversion/branches/1.9.x/subversion/tests/cmdline/davautocheck.sh Mon Jul 27 00:23:40 2015
@@ -296,8 +296,6 @@ LOAD_MOD_AUTHN_CORE="$(get_loadmodule_co
|| fail "Authn_Core module not found."
LOAD_MOD_AUTHZ_CORE="$(get_loadmodule_config mod_authz_core)" \
|| fail "Authz_Core module not found."
-LOAD_MOD_AUTHZ_HOST="$(get_loadmodule_config mod_authz_host)" \
- || fail "Authz_Host module not found."
LOAD_MOD_UNIXD=$(get_loadmodule_config mod_unixd) \
|| fail "UnixD module not found"
}
@@ -305,6 +303,10 @@ LOAD_MOD_AUTHN_FILE="$(get_loadmodule_co
|| fail "Authn_File module not found."
LOAD_MOD_AUTHZ_USER="$(get_loadmodule_config mod_authz_user)" \
|| fail "Authz_User module not found."
+LOAD_MOD_AUTHZ_GROUPFILE="$(get_loadmodule_config mod_authz_groupfile)" \
+ || fail "Authz_GroupFile module not found."
+LOAD_MOD_AUTHZ_HOST="$(get_loadmodule_config mod_authz_host)" \
+ || fail "Authz_Host module not found."
}
if [ ${APACHE_MPM:+set} ]; then
LOAD_MOD_MPM=$(get_loadmodule_config mod_mpm_$APACHE_MPM) \
@@ -341,6 +343,7 @@ else
BASE_URL="$BASE_URL:$HTTPD_PORT"
fi
HTTPD_USERS="$HTTPD_ROOT/users"
+HTTPD_GROUPS="$HTTPD_ROOT/groups"
mkdir "$HTTPD_ROOT" \
|| fail "couldn't create temporary directory '$HTTPD_ROOT'"
@@ -402,6 +405,14 @@ say "Adding users for lock authenticatio
$HTPASSWD -bc $HTTPD_USERS jrandom rayjandom
$HTPASSWD -b $HTTPD_USERS jconstant rayjandom
$HTPASSWD -b $HTTPD_USERS __dumpster__ __loadster__
+$HTPASSWD -b $HTTPD_USERS JRANDOM rayjandom
+$HTPASSWD -b $HTTPD_USERS JCONSTANT rayjandom
+
+say "Adding groups for mod_authz_svn tests"
+cat > "$HTTPD_GROUPS" <<__EOF__
+random: jrandom
+constant: jconstant
+__EOF__
touch $HTTPD_MIME_TYPES
@@ -425,7 +436,9 @@ $LOAD_MOD_AUTHN_CORE
$LOAD_MOD_AUTHN_FILE
$LOAD_MOD_AUTHZ_CORE
$LOAD_MOD_AUTHZ_USER
+$LOAD_MOD_AUTHZ_GROUPFILE
$LOAD_MOD_AUTHZ_HOST
+$LOAD_MOD_ACCESS_COMPAT
LoadModule authz_svn_module "$MOD_AUTHZ_SVN"
LoadModule dontdothat_module "$MOD_DONTDOTHAT"
@@ -531,6 +544,161 @@ CustomLog "$HTTPD_ROOT/ops" "%
SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
${SVN_PATH_AUTHZ_LINE}
</Location>
+<Location /authz-test-work/anon>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ # This may seem unnecessary but granting access to everyone here is necessary
+ # to exercise a bug with httpd 2.3.x+. The "Require all granted" syntax is
+ # new to 2.3.x+ which we can detect with the mod_authz_core.c module
+ # signature. Use the "Allow from all" syntax with older versions for symmetry.
+ <IfModule mod_authz_core.c>
+ Require all granted
+ </IfModule>
+ <IfModule !mod_authz_core.c>
+ Allow from all
+ </IfMOdule>
+ ${SVN_PATH_AUTHZ_LINE}
+</Location>
+<Location /authz-test-work/mixed>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ Require valid-user
+ Satisfy Any
+ ${SVN_PATH_AUTHZ_LINE}
+</Location>
+<Location /authz-test-work/mixed-noauthwhenanon>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ Require valid-user
+ AuthzSVNNoAuthWhenAnonymousAllowed On
+ SVNPathAuthz On
+</Location>
+<Location /authz-test-work/authn>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ Require valid-user
+ ${SVN_PATH_AUTHZ_LINE}
+</Location>
+<Location /authz-test-work/authn-anonoff>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ Require valid-user
+ AuthzSVNAnonymous Off
+ SVNPathAuthz On
+</Location>
+<Location /authz-test-work/authn-lcuser>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ Require valid-user
+ AuthzForceUsernameCase Lower
+ ${SVN_PATH_AUTHZ_LINE}
+</Location>
+<Location /authz-test-work/authn-lcuser>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ Require valid-user
+ AuthzForceUsernameCase Lower
+ ${SVN_PATH_AUTHZ_LINE}
+</Location>
+<Location /authz-test-work/authn-group>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ AuthGroupFile $HTTPD_GROUPS
+ Require group random
+ AuthzSVNAuthoritative Off
+ SVNPathAuthz On
+</Location>
+<IfModule mod_authz_core.c>
+ <Location /authz-test-work/sallrany>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ AuthzSendForbiddenOnFailure On
+ Satisfy All
+ <RequireAny>
+ Require valid-user
+ Require expr req('ALLOW') == '1'
+ </RequireAny>
+ ${SVN_PATH_AUTHZ_LINE}
+ </Location>
+ <Location /authz-test-work/sallrall>
+ DAV svn
+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
+ SVNListParentPath On
+ AuthType Basic
+ AuthName "Subversion Repository"
+ AuthUserFile $HTTPD_USERS
+ AuthzSendForbiddenOnFailure On
+ Satisfy All
+ <RequireAll>
+ Require valid-user
+ Require expr req('ALLOW') == '1'
+ </RequireAll>
+ ${SVN_PATH_AUTHZ_LINE}
+ </Location>
+</IfModule>
RedirectMatch permanent ^/svn-test-work/repositories/REDIRECT-PERM-(.*)\$ /svn-test-work/repositories/\$1
RedirectMatch ^/svn-test-work/repositories/REDIRECT-TEMP-(.*)\$ /svn-test-work/repositories/\$1
__EOF__