Re: RFC: Subversion security model in need of update

David Glasser wrote:
> I think you have my concern backwards. It's clear that the current
> explicit-path-list authz implementations can be adapted to Mike's
> proposed model. My concern is that the model limits authz
> implementations to only be those essentially the same as the current
> one, where all interesting paths are explicitly listed.

Yes, this is absolutely correct. And, in fact, our CEE integration --
which, again, uses regular expressions to define readable regions -- suffers
a nasty performance penalty (in ViewVC, where this custom authz checking
occurs) while trying to answer the, "Can I see this?" question when the
target item is only implicitly accessible. This is not an ideal situation,
but (as you said) doesn't affect Subversion's stock implementation of an
authz module.

Of course, a solution that doesn't force alternative authz implementations
into this performance penalty would clearly be a better one to have.

-- 
C. Michael Pilato <cmpilato_at_collab.net>
CollabNet   <>   www.collab.net   <>   Distributed Development On Demand
------------------------------------------------------
http://subversion.tigris.org/ds/viewMessage.do?dsForumId=462&dsMessageId=1314622