* Michael W Thelen <thelenm@cs.utah.edu> [2004-07-06 15:53]:
> * Ben Collins-Sussman <sussman@collab.net> [2004-07-06 15:47]:
> > Of course we know the fix. mod_authz_svn reads the entire authz INI
> > file into memory for every request. All we need to do is
> >
> > 1. write a function in mod_authz_svn.c which verifies whether a user
> > has read access to an entire tree. That's just a matter of looping over
> > all paths in the authz file which prefix-match the tree.
> >
> > 2. invoke this function on the source path of any COPY request.
> >
> > Pretty easy stuff. Personally, I think we should do it. COPY requests
> > (svn cp URL1 URL2) are relatively rare, and we can document the fact
> > that mod_authz_svn places a bit of a damper on O(1) copies.
>
> Hey, that sounds like something even I could do :) Anyone mind if I
> give it a shot tonight and post again tomorrow if it looks like it's
> going to be beyond me?
So... I'm feeling pretty good about being able to fix this, except for
one thing. How do you get the list of all paths in the authz file in
order to loop over them?
The current code checks all paths from the requested path upward, by
chopping basenames one at a time and calling svn_config_enumerate for
each parent directory. That doesn't require knowing all the sections in
the authz file, because you can examine the requested path and deduce
all its parent directories. But going downward, we need a list of all
sections in the authz file, and I can't figure out how to get them. At
the point I need them in mod_authz_svn.c, I have a svn_config_t*, but no
direct access to what's in there since I haven't included config_impl.h
(which I assume is a bad idea since it hasn't already been done). I'm
thinking that a new svn_config function is needed to provide the full
list of config sections (or call a callback for each one). Any other
suggestions?
-- Mike
--
Michael W. Thelen
How many a man has dated a new era in his life from the reading of a book.
-- Henry David Thoreau
Received on Wed Jul 7 09:41:57 2004