Re: Authz on Collection of Repositories (was: Expansion of authz policy name leak)

>
> I'm working on the patch to list only readable repositories. There is
>
already TODO comment in the code by cmpilato:
> subversion\mod_dav_svn\repos.c:3461
>

Please keep in mind that the problem is not restricted to parent-path
collections
of repositories: Since SVN 1.7 any user can "list" the root of a
"standalone"
repository even if she has no access grants whatsoever. Of course, the
listing
will be empty in this case (but the head revision is leaked).

Cheers, Roderich
Received on 2012-10-23 14:23:13 CEST