You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Thorsten Schöning <ts...@am-soft.de> on 2015/08/10 20:22:49 UTC
SVNListParentPath without path based authz checks?
Hi all,
I'm currently trying to implement access to my svn repos using
mod_dav_svn and all my repos have a authz file to define who can
access which paths. I would like to be able to have a listing of all
available repos without the need for any authorization, but instead
only if any path within the repo gets accessed authorization should be
required.
My configuration is as follows:
> <Location "/bin">
> DAV svn
> SVNParentPath /home/ams_svn_repos/Bin
> SVNListParentPath On
> AuthzSVNReposRelativeAccessFile authz
> </Location>
The problem now is that my repos are only visible in the dir listing
if I change my authz file to give everyone read access in "/", which
is of course not what I want. If I don't the repo's name is not
mentioned in the listing and from reading through the logs I can see
that the authz file gets processed and specifies denied access.
If I remove the processing of the authz file the listing works of
course, but I need path based access checking for the contents of the
repo.
Is this behavior by design or am I doing something wrong? From my
point of view "SVNListParentPath" is managed outside of the repo and
therefore authz should be ignored on that level.
Thanks for your input!
Mit freundlichen Grüßen,
Thorsten Schöning
--
Thorsten Schöning E-Mail: Thorsten.Schoening@AM-SoFT.de
AM-SoFT IT-Systeme http://www.AM-SoFT.de/
Telefon...........05151- 9468- 55
Fax...............05151- 9468- 88
Mobil..............0178-8 9468- 04
AM-SoFT GmbH IT-Systeme, Brandenburger Str. 7c, 31789 Hameln
AG Hannover HRB 207 694 - Geschäftsführer: Andreas Muchow
Re: SVNListParentPath without path based authz checks?
Posted by Eric Johnson <er...@tibco.com>.
Hi Thorsten,
On Thu, Aug 13, 2015 at 12:10 AM, Thorsten Schöning <ts...@am-soft.de>
wrote:
> Guten Tag Eric Johnson,
> am Montag, 10. August 2015 um 22:55 schrieben Sie:
>
> > We let Subversion limit the listed repositories, and we have a
> > separate generated list of repositories.
>
> How do you generate it, did you build some little tool on your own or
> are you using some kind of web app like WebSVN? I like and use the
> latter to provide web downloads, but sadly it's not maintained
> anymore.
>
>
At my company, we generate the access file from other sources. So at the
same time we're generating that, we also generate a list of repositories as
a static HTML page.
Without knowing the specifics of your setup, if you're editing the file
directly, just scan the access file when changed, and generate HTML....
Eric.
Re: SVNListParentPath without path based authz checks?
Posted by Thorsten Schöning <ts...@am-soft.de>.
Guten Tag Eric Johnson,
am Montag, 10. August 2015 um 22:55 schrieben Sie:
> We let Subversion limit the listed repositories, and we have a
> separate generated list of repositories.
How do you generate it, did you build some little tool on your own or
are you using some kind of web app like WebSVN? I like and use the
latter to provide web downloads, but sadly it's not maintained
anymore.
Mit freundlichen Grüßen,
Thorsten Schöning
--
Thorsten Schöning E-Mail: Thorsten.Schoening@AM-SoFT.de
AM-SoFT IT-Systeme http://www.AM-SoFT.de/
Telefon...........05151- 9468- 55
Fax...............05151- 9468- 88
Mobil..............0178-8 9468- 04
AM-SoFT GmbH IT-Systeme, Brandenburger Str. 7c, 31789 Hameln
AG Hannover HRB 207 694 - Geschäftsführer: Andreas Muchow
Re: SVNListParentPath without path based authz checks?
Posted by Eric Johnson <er...@tibco.com>.
Curious. You've come to the opposite conclusion from what we've deployed at
my company.
We let Subversion limit the listed repositories, and we have a separate
generated list of repositories.
That way, you're not playing with Subversion's access file to try to get it
right. Leave that alone, and show the list elsewhere. Seems safer, from a
security perspective - in that you cannot accidentally expose what you
don't want to.
Eric.
On Mon, Aug 10, 2015 at 11:22 AM, Thorsten Schöning <ts...@am-soft.de>
wrote:
> Hi all,
>
> I'm currently trying to implement access to my svn repos using
> mod_dav_svn and all my repos have a authz file to define who can
> access which paths. I would like to be able to have a listing of all
> available repos without the need for any authorization, but instead
> only if any path within the repo gets accessed authorization should be
> required.
>
> My configuration is as follows:
>
> > <Location "/bin">
> > DAV svn
> > SVNParentPath /home/ams_svn_repos/Bin
> > SVNListParentPath On
> > AuthzSVNReposRelativeAccessFile authz
> > </Location>
>
> The problem now is that my repos are only visible in the dir listing
> if I change my authz file to give everyone read access in "/", which
> is of course not what I want. If I don't the repo's name is not
> mentioned in the listing and from reading through the logs I can see
> that the authz file gets processed and specifies denied access.
>
> If I remove the processing of the authz file the listing works of
> course, but I need path based access checking for the contents of the
> repo.
>
> Is this behavior by design or am I doing something wrong? From my
> point of view "SVNListParentPath" is managed outside of the repo and
> therefore authz should be ignored on that level.
>
> Thanks for your input!
>
> Mit freundlichen Grüßen,
>
> Thorsten Schöning
>
> --
> Thorsten Schöning E-Mail: Thorsten.Schoening@AM-SoFT.de
> AM-SoFT IT-Systeme http://www.AM-SoFT.de/
>
> Telefon...........05151- 9468- 55
> Fax...............05151- 9468- 88
> Mobil..............0178-8 9468- 04
>
> AM-SoFT GmbH IT-Systeme, Brandenburger Str. 7c, 31789 Hameln
> AG Hannover HRB 207 694 - Geschäftsführer: Andreas Muchow
>
>
Re: SVNListParentPath without path based authz checks?
Posted by Thorsten Schöning <ts...@am-soft.de>.
Guten Tag Daniel Shahaf,
am Mittwoch, 12. August 2015 um 00:33 schrieben Sie:
> SVNListParentPath used to list all repositories, but not too long ago
> that was changed to only list repositories that the authenticated user
> has access to. (I can't find the commit that made the change, and
> I don't recall whether the required access is "r access to the root of
> that repository" or "r access to at least one path in that repository".)
For the docs: Regarding my tests it's "r access to the root of that
repository" and therefore doesn't work very well with my intended
setup to allow all "the world" to see the list of repos, because for
that to work, "*" would need to be granted read access at the root
level, which would get inherited and need to be revoked for subdirs
until one adds a new subdir and forgets to revoke...
> I'm not sure how to achieve what you want with mod_dav_svn 1.9.0.
> Perhaps there's an httpd.conf trick you could use? You'll want to have
> the authz check return TRUE when the original request is for the
> SVNListParentPath dir, and FALSE when the original request is attempting
> to access the repository root or anything within the repository.
I tried that using a PerlAuthzHandler, but 1. it needs authentication
first, whereas I thought of letting everyone see the list, and 2. and
more problematic I can't get it to forward the authz handling to
mod_dav_svn for every request which is not only listing the repos. I
can distinct both simply using the requested URL and can allow access
for the listing itself, but returning DECLINED to forward to other
handlers doesn't seem to have any effect. I guess because mod_dav_svn
simply is not part of mod_perl handlers[2].
Looks like I need to present the list of repos some other way if
really needed.
[1] https://perl.apache.org/docs/2.0/user/handlers/http.html#PerlAuthzHandler
[2] https://perl.apache.org/docs/2.0/user/handlers/intro.html#Stacked_Handlers
Mit freundlichen Grüßen,
Thorsten Schöning
--
Thorsten Schöning E-Mail: Thorsten.Schoening@AM-SoFT.de
AM-SoFT IT-Systeme http://www.AM-SoFT.de/
Telefon...........05151- 9468- 55
Fax...............05151- 9468- 88
Mobil..............0178-8 9468- 04
AM-SoFT GmbH IT-Systeme, Brandenburger Str. 7c, 31789 Hameln
AG Hannover HRB 207 694 - Geschäftsführer: Andreas Muchow
Re: SVNListParentPath without path based authz checks?
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Philip Martin wrote on Wed, Aug 12, 2015 at 02:20:51 +0100:
> Daniel Shahaf <d....@daniel.shahaf.name> writes:
>
> > SVNListParentPath used to list all repositories, but not too long ago
> > that was changed to only list repositories that the authenticated user
> > has access to. (I can't find the commit that made the change, and
> > I don't recall whether the required access is "r access to the root of
> > that repository" or "r access to at least one path in that repository".)
>
> Perhaps you are thinking of r933194 and issue 2753? SVNListParentPath
> in combination with authz didn't really work at all until that was
> fixed.
No, I was thinking of r1408184.
Between r933194 and r1408184, SVNListParentPath showed all repositories;
after r1408184, SVNListParentPath only shows repositories the user has
access to.
Thanks,
Daniel
Re: SVNListParentPath without path based authz checks?
Posted by Philip Martin <ph...@wandisco.com>.
Daniel Shahaf <d....@daniel.shahaf.name> writes:
> SVNListParentPath used to list all repositories, but not too long ago
> that was changed to only list repositories that the authenticated user
> has access to. (I can't find the commit that made the change, and
> I don't recall whether the required access is "r access to the root of
> that repository" or "r access to at least one path in that repository".)
Perhaps you are thinking of r933194 and issue 2753? SVNListParentPath
in combination with authz didn't really work at all until that was
fixed.
--
Philip Martin
WANdisco
Re: SVNListParentPath without path based authz checks?
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Thorsten Schöning wrote on Mon, Aug 10, 2015 at 20:22:49 +0200:
> Is this behavior by design or am I doing something wrong? From my
> point of view "SVNListParentPath" is managed outside of the repo and
> therefore authz should be ignored on that level.
SVNListParentPath used to list all repositories, but not too long ago
that was changed to only list repositories that the authenticated user
has access to. (I can't find the commit that made the change, and
I don't recall whether the required access is "r access to the root of
that repository" or "r access to at least one path in that repository".)
I don't believe we made that configurable.
I'm not sure how to achieve what you want with mod_dav_svn 1.9.0.
Perhaps there's an httpd.conf trick you could use? You'll want to have
the authz check return TRUE when the original request is for the
SVNListParentPath dir, and FALSE when the original request is attempting
to access the repository root or anything within the repository.