Alexy Khrabrov <alexy.khrabrov@setup.org> writes:
> * subversion/mod_dav_svn/util.c
> (dav_svn_build_uri) cannot have the resulting path starting with //,
> thus should not insert root_path in "...%s/..." when it is only /.
>
> Index: subversion/mod_dav_svn/util.c
> ===================================================================
> --- subversion/mod_dav_svn/util.c
> +++ subversion/mod_dav_svn/util.c Wed Jul 31 23:30:56 2002
> @@ -108,6 +108,8 @@
> const char *href1 = add_href ? "<D:href>" : "";
> const char *href2 = add_href ? "</D:href>" : "";
>
> + if (strcmp(root_path, "/") == 0) root_path = "";
> +
> switch (what)
> {
> case DAV_SVN_BUILD_URI_ACT_COLLECTION:
Is this check thorough enough?
root_path comes from repos->root_path. The `repos' struct is of type
`dav_svn_repos'. Here's the documentation for the `root_path' field
in that struct:
/* Remember the root URL path of this repository (just a path; no
scheme, host, or port).
Example: the URI is "http://host/repos/file", this will be "/repos". */
const char *root_path;
This documentation does not explicitly say that root_path never ends
in a slash (when it has a non-empty component), although the example
implies it. If we can count on that, then your patch is robust
enough, but we should also change the documentation in dav_svn.h so
this promise is explicit.
But if it's ever possible to get "/repos/", for example, then
dav_svn_build_uri() would need to simply check for a trailing slash
last character and make sure not to add another slash in that case.
This algorithm, while less efficient, solves the problem in both the
"/" case and any other case. I'm not saying we have to do that, but
we should sure it's not necessary before we go with the "/"-only
algorithm of your patch.
What happens if dav_svn_get_resource() is called for a Location that
ends in a trailing slash? For example, someone writes
<Location /foo/bar/>
in httpd.conf. Won't root_path still have that trailing slash by the
time we do your check? Is this a problem?
Greg Stein, help? :-)
-Karl
> Problem description:
>
> When hosting SVN at the root of a (virtual) host with URI like
> http://svn.host.tld/, mod_dav_svn.so fed the command client wrong
> properties, starting with //. This was handled by a browser, but not
> by the command-line svn, so svn ls http://svn.host.tld/ was returning
> with Forbidden 403, as it tried to read //!svn/vcc/default, etc.
> The solution is to check in mod_dav_svn/util.c whether the root_path is /,
> and in that case not to insert it into the result. The patch follows.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Tue Aug 6 18:35:21 2002