[PATCH] storing auth after auth failure

Philip Martin <philip@codematters.co.uk> writes:

> Branko Èibej <brane@xbc.nu> writes:
>
>> With write access to the tsvn repo, I can confirm this -- both 1.2.2
>> and trunk.
>>
>> Stefan, thanks, you can revoke my write access now.
>
> I appear to have (write?) access, and yes I also get a crash.

I stepped through trunk client aginst tsvn server:

  a) the client calls svn_ra_dav__lock

  b) svn_ra_dav__lock calls shim_svn_ra_dav__lock

  c) shim_svn_ra_dav__lock calls svn_ra_dav__get_baseline_info which
     prompts for auth and succeeds

  d) shim_svn_ra_dav__lock calls ne_lock which prompts for auth three
     times, the first prompt is for a password, the second and third
     prompts are for both username and password.

  e) the ne_lock call fails and returns 1 (or NE_ERROR)

  f) shim_svn_ra_dav__lock calls svn_ra_dav__convert_error which
     creates an SVN_ERR_RA_DAV_REQUEST_FAILED error

  g) shim_svn_ra_dav__lock returns to svn_ra_dav__lock

  h) svn_ra_dav__lock
     calls
     svn_ra_dav__maybe_store_auth_info_after_result
     which calls
     svn_ra_dav__maybe_store_auth_info
     which calls
     svn_auth_save_credentials

  i) svn_auth_save_credentials retieves a NULL provider and then SEGVs
     accessing provider->vtable->save_credentials

I don't really understand the auth stuff, but I think the fact that
(d) prompts three times indicates that the auth is failing. It seems
that there are two things that could be considered bugs:

   1) the ra_dav code does not recognise the error as an auth failure
      because ne_lock returns NE_ERROR rather than NE_AUTH (I'm using
      neon 0.24.7)

   2) the auth code crashes when asked to store auth after an auth
      failure

I don't know whether, or how, we should fix (1) but I can fix (2)
using this:

Index: subversion/libsvn_subr/auth.c
===================================================================
--- subversion/libsvn_subr/auth.c (revision 15679)
+++ subversion/libsvn_subr/auth.c (working copy)
@@ -297,7 +297,7 @@
   svn_auth_baton_t *auth_baton;
   void *creds;
 
- if (! state)
+ if (! state || state->table->providers->nelts == state->provider_idx)
     return SVN_NO_ERROR;
 
   auth_baton = state->auth_baton;

and then the client gives me

$ svn lock wc/Doxyfile --username guest
...
svn: Lock request failed: 401 Authorization Required (http://tortoisesvn.tigris.org)

I don't know whether it's sensible to silently do nothing when storing
auth after an auth failure, perhaps an error should be returned.

-- 
Philip Martin
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org