You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Philip Martin <ph...@codematters.co.uk> on 2005/11/01 18:24:08 UTC
svnserve access control change
With 1.2 I could enable anonymous write access over ra_svn by doing:
$ svnserve -dr.
$ svnadmin create repo
$ echo [general] >> repo/conf/svnserve.conf
$ echo anon-access = write >> repo/conf/svnserve.conf
With trunk that no longer works, commits now give me
$ svn mkdir -m "" svn://localhost/repo/foo
../svn/subversion/svnserve/serve.c:434: (apr_err=170001)
svn: Authorization failed
I think this is caused by the new svnserve authz stuff, but I haven't
investigated fully. Is this a known change in behaviour or am I
making a mistake?
--
Philip Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: [PATCH] Allow anonymous ra_svn write access
Posted by David Anderson <da...@calixo.net>.
Paul Burba wrote:
> For now I'm going to continue testing my 1.3 ebcdic port (which is
> how I originally came across the same problem you did) with my patch
> in place and see if anything else falls out. In the meantime, if
> someone out there knows this section of code and can spare some time
> to take a look at either patch, please do.
I've just had a peek (I wrote the original authz code for svnserve).
From what we're able to determine over IRC, the bug is due to an
oversight on my part: thinking that 0 lock tokens meant lock_tokens ==
NULL, when in fact NULL is for pre-1.2 compatibility and a list of 0
tokens is default post-1.2.
In that context, it is Philip's patch that fixes the bug in the correct
way. Your patch also corrects it, but at a lower level, inside a
routine used by many other routines. And in some contexts in which this
function gets called, the absence of an authz_db doesn't mean you can
skip needs_username requirements. So, I think your fix could trigger
invalid clearances in some other places.
I'll commit Philip's patch in a minute, and nominate it for 1.3.x.
Thanks to both of you for spending the time to track this one down!
- Dave.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: [PATCH] Allow anonymous ra_svn write access
Posted by Paul Burba <pa...@softlanding.com>.
Philip Martin <ph...@codematters.co.uk> wrote on 11/01/2005 04:04:15 PM:
> Philip Martin <ph...@codematters.co.uk> writes:
>
> > It looks like it's a result of the way the authz stuff handles lock
> > tokens. I'm don't know much about this bit of code, does the
> > following look sensible?
> >
> > Fix a bug that caused anonymous write access over ra_svn to fail
> > with "Authorization failed" errors.
> >
> > * subversion/svnserve/serve.c
> > (commit): Don't require a username if there are no lock tokens.
>
> The patch Paul Burba just posted in a separate thread also does the
> trick; I suspect his approach might be better, but I don't really know
> the code well enough to say.
Hi Philip,
Both of our patches solve the original problem, but like you, I'm not
entirely sure which is better and judging if there are no unintended
side-effects from either...well that's another question entirely.
For now I'm going to continue testing my 1.3 ebcdic port (which is how I
originally came across the same problem you did) with my patch in place
and see if anything else falls out. In the meantime, if someone out there
knows this section of code and can spare some time to take a look at
either patch, please do.
Paul B.
_____________________________________________________________________________
Scanned for SoftLanding Systems, Inc. and SoftLanding Europe Plc by IBM Email Security Management Services powered by MessageLabs.
_____________________________________________________________________________
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: [PATCH] Allow anonymous ra_svn write access
Posted by Philip Martin <ph...@codematters.co.uk>.
Philip Martin <ph...@codematters.co.uk> writes:
> It looks like it's a result of the way the authz stuff handles lock
> tokens. I'm don't know much about this bit of code, does the
> following look sensible?
>
> Fix a bug that caused anonymous write access over ra_svn to fail
> with "Authorization failed" errors.
>
> * subversion/svnserve/serve.c
> (commit): Don't require a username if there are no lock tokens.
The patch Paul Burba just posted in a separate thread also does the
trick; I suspect his approach might be better, but I don't really know
the code well enough to say.
--
Philip Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
[PATCH] Allow anonymous ra_svn write access
Posted by Philip Martin <ph...@codematters.co.uk>.
Philip Martin <ph...@codematters.co.uk> writes:
> With 1.2 I could enable anonymous write access over ra_svn by doing:
>
> $ svnserve -dr.
> $ svnadmin create repo
> $ echo [general] >> repo/conf/svnserve.conf
> $ echo anon-access = write >> repo/conf/svnserve.conf
>
> With trunk that no longer works, commits now give me
>
> $ svn mkdir -m "" svn://localhost/repo/foo
> ../svn/subversion/svnserve/serve.c:434: (apr_err=170001)
> svn: Authorization failed
>
> I think this is caused by the new svnserve authz stuff, but I haven't
> investigated fully. Is this a known change in behaviour or am I
> making a mistake?
It looks like it's a result of the way the authz stuff handles lock
tokens. I'm don't know much about this bit of code, does the
following look sensible?
Fix a bug that caused anonymous write access over ra_svn to fail
with "Authorization failed" errors.
* subversion/svnserve/serve.c
(commit): Don't require a username if there are no lock tokens.
Index: subversion/svnserve/serve.c
===================================================================
--- subversion/svnserve/serve.c (revision 17136)
+++ subversion/svnserve/serve.c (working copy)
@@ -922,11 +922,12 @@
adding tokens (if we have any), and subsequently fail if a lock
violates authz. */
SVN_ERR(must_have_access(conn, pool, b, svn_authz_write,
- NULL, lock_tokens ? TRUE : FALSE));
+ NULL,
+ (lock_tokens && lock_tokens->nelts) ? TRUE : FALSE));
/* Authorize the lock tokens and give them to the FS if we got
any. */
- if (lock_tokens)
+ if (lock_tokens && lock_tokens->nelts)
SVN_CMD_ERR(add_lock_tokens(conn, lock_tokens, b, pool));
ccb.pool = pool;
@@ -955,7 +956,7 @@
SVN_ERR(svn_fs_deltify_revision(b->fs, new_rev, pool));
/* Unlock the paths. */
- if (! keep_locks && lock_tokens)
+ if (! keep_locks && lock_tokens && lock_tokens->nelts)
SVN_ERR(unlock_paths(lock_tokens, b, pool));
SVN_ERR(svn_ra_svn_write_tuple(conn, pool, "r(?c)(?c)",
--
Philip Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org