[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: Repo browser can access restricted folders by changing the case of repository folders

From: Andy Levy <andy.levy_at_gmail.com>
Date: Thu, 6 Dec 2012 06:25:31 -0500

On Dec 6, 2012 4:34 AM, "Zulqarnain Sarani" <z.sarani_at_efficiencyleaders.com>
wrote:
>
> Hi Support,
>
>
>
> Thanks for taking your time to look into this. I would like to explain
the scenario as best as I can regarding the issue we are currently facing.
>
> The version used are:
>
>
>
> VisualSVN Server 2.5.7
>
> SubVersion 1.7.7
>
> TortoiseSVN 1.7.10
>
>
>
> We have created a repository called “testrepository” using VisualSVN
Server and has given “No Access” to everyone meaning that no one should be
able to access the repository as it has been restricted for everyone.
>
> But for some odd reason when I try to access the above repository using
“repo browser” provided by TortoiseSVN by typing in the complete SVN URL
such as https://svnURL/svn/TESTREPOSITORY
>
> the restricted folder seems to be accessible meaning that by changing the
case, the whole restricted repository becomes available.
>
>
>
> Has this issue been encountered earlier or fixed.

This is not a Tortoise problem. Subversion is case sensitive (everywhere),
but Windows is not. So what's happening is Apache is finding the repository
regardless of the casing in the URL, but the Subversion authz module finds
no matching path. You probably allow anonymous access to the repository at
some level, so that ends up being what you get with the improperly cased
URL.

The only way to fix it is to use *NIX for your server, or patch Apache
heavily to keep it case sensitive even on case insensitive host systems.

------------------------------------------------------
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=3033688

To unsubscribe from this discussion, e-mail: [users-unsubscribe_at_tortoisesvn.tigris.org].
Received on 2012-12-06 12:25:36 CET

This is an archived mail posted to the TortoiseSVN Users mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.