You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by jo...@apache.org on 2014/03/19 16:12:04 UTC
git commit: [#6701] Return 401 Unauthorized instead of 403 Forbidden
when anonymous access is denied to force client to prompt for auth
Repository: incubator-allura
Updated Branches:
refs/heads/cj/6701 7cae9a14a -> 9dd51338e
[#6701] Return 401 Unauthorized instead of 403 Forbidden when anonymous access is denied to force client to prompt for auth
Signed-off-by: Cory Johns <cj...@slashdotmedia.com>
Project: http://git-wip-us.apache.org/repos/asf/incubator-allura/repo
Commit: http://git-wip-us.apache.org/repos/asf/incubator-allura/commit/9dd51338
Tree: http://git-wip-us.apache.org/repos/asf/incubator-allura/tree/9dd51338
Diff: http://git-wip-us.apache.org/repos/asf/incubator-allura/diff/9dd51338
Branch: refs/heads/cj/6701
Commit: 9dd51338ed50f424f2633686db48087918fa086b
Parents: 7cae9a1
Author: Cory Johns <cj...@slashdotmedia.com>
Authored: Wed Mar 19 15:11:50 2014 +0000
Committer: Cory Johns <cj...@slashdotmedia.com>
Committed: Wed Mar 19 15:11:50 2014 +0000
----------------------------------------------------------------------
scripts/ApacheAccessHandler.py | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/incubator-allura/blob/9dd51338/scripts/ApacheAccessHandler.py
----------------------------------------------------------------------
diff --git a/scripts/ApacheAccessHandler.py b/scripts/ApacheAccessHandler.py
index 946898b..390dca3 100644
--- a/scripts/ApacheAccessHandler.py
+++ b/scripts/ApacheAccessHandler.py
@@ -128,10 +128,14 @@ def handler(req):
if not check_repo_path(req):
return apache.HTTP_NOT_FOUND
- if req.user and not check_authentication(req):
+ authenticated = check_authentication(req)
+ if req.user and not authenticated:
return apache.HTTP_UNAUTHORIZED
- if not check_permissions(req):
+ authorized = check_permissions(req)
+ if not req.user and not authorized:
+ return apache.HTTP_UNAUTHORIZED
+ elif not authorized:
return apache.HTTP_FORBIDDEN
return apache.OK