[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

authz changes between 1.9 and 1.10

From: Philip Martin <philip_at_codematters.co.uk>
Date: Fri, 20 Jul 2018 13:59:04 +0100

In 1.9 it was possible to repeat, or reopen, a section:

  [/some/path]
  user = r
  [/some/path]
  otheruser = rw

This was equivalent to a single section:

  [/some/path]
  user = r
  otheruser = rw

In 1.10 this is rejected by the parser and cannot be used. Is this a
bug in 1.10 or an acceptable behaviour change?

In 1.9 any repeat acl lines that were the exact same match, such as:

  [/some/path]
  user = rw
  user = r

resulted in the last line overriding all the other lines, so user=r in
the example above. In 1.10 the lines combine, so user=rw in the example
above. Is this a bug in 1.10, or a bug in 1.9 that is fixed in 1.10, or
an acceptable behaviour change?

Finally, issue 4762. In 1.9 if both global and per-repository sections
matched they were combined, so:

   [/some/path]
   user = rw
   [repos:/some/path]
   user = r

resulted in user=rw. The issue 4762 problem is that in 1.10 the
per-repository section overrides any global section, so user=r above. I
believe this is a 1.10 bug and that the 1.9 behaviour should be
reinstated. However, consider glob rules:
   
   [:glob:/some/*]
   user = rw
   [:glob:repos:/some/*]
   user = r

At present the per-repository section override the global section just
like the buggy behaviour for non-glob sections. If we fix 4762 to
reinstate the combining for non-glob sections should we change the
behaviour of glob sections so they combine as well? What about a
non-glob and glob section:

   [/some/path]
   user = rw
   [:glob:repos:/some/path]
   user = r

Should these combine?

Glob sections are new so they could have different behaviour from
non-glob sections, but is that what we want? There is a wiki page
https://cwiki.apache.org/confluence/display/SVN/AuthzImprovements but
given issue 4762 I not sure whether it describes the correct behaviour.

-- 
Philip
Received on 2018-07-20 14:59:16 CEST

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.