Re: [PATCH]: don't store auth info in world-readable files

David Kimdon wrote:
> Hi,
>
> The included patch makes the .svn/auth/ files only readable by the current
> user. I was motivated to create this patch by a bug report that can be found
> at http://bugs.debian.org/162953 . In the spirit of openness I could have left
> the username file world readable but life is simpler if everything in the auth
> dir is only u+r. The patch passed 'make check'.

This gets mentioned every now and then. .svn/auth/* are world-readable,
but .svn/auth is not world-traversable. So I don't see any real security
problem here.

Scott

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Thu Oct 3 07:01:13 2002