Re: mod_authz_svn bug with multiple directories

--On Tuesday, March 2, 2004 9:23 PM -0800 Robert Spier <rspier@pobox.com>
wrote:

> I think I may have found a bug (or at least "user assumption failure")
> in mod_authz_svn.

I'd classify it as a mix between 'pilot error' and bug. ;-)

> If a user has access to two directories, but not the parent directory,
>
> (i.e.
> [/test/level1/level2]
> guest = rw
> [/test/level1/level2a]
> guest = rw
> )
>
> a commit to both of those two directories will result in a MERGE
> request to the directory above. (/test/level1)
>
> BUT - since the user can't write there, the MERGE result fails.
>
> *kaboom*

Correct. To fix, guest would need rw on the parent directory as well.
However, committing independently should resolve the problem. Does it?

I'm not sure what else we can do here. Perhaps we could build in some logic
that if someone can write to a child directory, MERGE should then succeed?
(i.e. an implicit w permission to call MERGE.) Although I think that might
open us up a bit too much. -- justin

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Wed Mar 3 10:09:59 2004