You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Greg Hudson <gh...@MIT.EDU> on 2003/12/01 07:27:11 UTC
Found read-only security hole in svnserve
svnserve's compatibility code for old clients was allowing clients to
read a repository even if anon-access was set to "none". I've fixed
this in r7888. This probably warrants an 0.33.2 if at all possible.
Sorry about that.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Found read-only security hole in svnserve
Posted by Erik Huelsmann <e....@gmx.net>.
I agree. Releasing 0.33.2 today and 0.34.0 two days from now might be
confusing.
bye,
Erik.
> On Mon, Dec 01, 2003 at 02:27:11AM -0500, Greg Hudson wrote:
> > svnserve's compatibility code for old clients was allowing clients to
> > read a repository even if anon-access was set to "none". I've fixed
> > this in r7888. This probably warrants an 0.33.2 if at all possible.
>
> I'd say port the fix over to 0.34 and recommend an upgrade to that
> instead. If we have to make a release, then I'd say stick to just 0.34.
>
> Cheers,
> -g
>
> --
> Greg Stein, http://www.lyra.org/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
> For additional commands, e-mail: dev-help@subversion.tigris.org
>
--
HoHoHo! Seid Ihr auch alle sch�n brav gewesen?
GMX Weihnachts-Special: Die 1. Adresse f�r Weihnachts-
m�nner und -frauen! http://www.gmx.net/de/cgi/specialmail
+++ GMX - die erste Adresse f�r Mail, Message, More! +++
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Found read-only security hole in svnserve
Posted by Greg Hudson <gh...@MIT.EDU>.
On Mon, 2003-12-01 at 05:30, Greg Stein wrote:
> On Mon, Dec 01, 2003 at 02:27:11AM -0500, Greg Hudson wrote:
> > svnserve's compatibility code for old clients was allowing clients to
> > read a repository even if anon-access was set to "none". I've fixed
> > this in r7888. This probably warrants an 0.33.2 if at all possible.
>
> I'd say port the fix over to 0.34 and recommend an upgrade to that
> instead. If we have to make a release, then I'd say stick to just 0.34.
Okay. I guess if people don't want to immediately deal with dumping and
loading their repositories to upgrade to 0.34, they can apply a source
patch to 0.33.1.
(The number of users affected by the problem is probably miniscule
anyway.)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Found read-only security hole in svnserve
Posted by Greg Stein <gs...@lyra.org>.
On Mon, Dec 01, 2003 at 02:27:11AM -0500, Greg Hudson wrote:
> svnserve's compatibility code for old clients was allowing clients to
> read a repository even if anon-access was set to "none". I've fixed
> this in r7888. This probably warrants an 0.33.2 if at all possible.
I'd say port the fix over to 0.34 and recommend an upgrade to that
instead. If we have to make a release, then I'd say stick to just 0.34.
Cheers,
-g
--
Greg Stein, http://www.lyra.org/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Found read-only security hole in svnserve
Posted by "Jostein Chr. Andersen" <jo...@josander.net>.
On Monday 01 December 2003 10.51, Erik Huelsmann wrote:
> At least it deserves a place in 0.34.0; Jostein, do you agree?
+1
Yes, at least.
J.
--
http://www.josander.net/kontakt/ ||
http://www.josander.net/en/contact/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: Found read-only security hole in svnserve
Posted by Erik Huelsmann <e....@gmx.net>.
At least it deserves a place in 0.34.0; Jostein, do you agree?
bye,
Erik.
> svnserve's compatibility code for old clients was allowing clients to
> read a repository even if anon-access was set to "none". I've fixed
> this in r7888. This probably warrants an 0.33.2 if at all possible.
>
> Sorry about that.
--
HoHoHo! Seid Ihr auch alle sch�n brav gewesen?
GMX Weihnachts-Special: Die 1. Adresse f�r Weihnachts-
m�nner und -frauen! http://www.gmx.net/de/cgi/specialmail
+++ GMX - die erste Adresse f�r Mail, Message, More! +++
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org