Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-24 Thread Daniel Shahaf
Branko Čibej wrote on Tue, Jan 20, 2015 at 13:13:05 +0100: > On 20 Jan 2015 12:54, "Ivan Zhakov" wrote: > > > On 20 January 2015 at 14:15, Branko Čibej wrote: > > > On 19.01.2015 18:10, Ivan Zhakov wrote: > > >> I've implemented proposed behavior in r1653032. > > >> > > >> On 18 January 2015 at

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-20 Thread Ivan Zhakov
On 20 January 2015 at 15:13, Branko Čibej wrote: > Right, understood. So 'hiding path" is not wording that mod_authz_svn can > use, but we can come up with some authz-specific wording that's different > from the current "access denied," right? > Yes, right. -- Ivan Zhakov

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-20 Thread Branko Čibej
Right, understood. So 'hiding path" is not wording that mod_authz_svn can use, but we can come up with some authz-specific wording that's different from the current "access denied," right? On 20 Jan 2015 12:54, "Ivan Zhakov" wrote: > On 20 January 2015 at 14:15, Branko Čibej wrote: > > On 19.01.

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-20 Thread Ivan Zhakov
On 20 January 2015 at 14:15, Branko Čibej wrote: > On 19.01.2015 18:10, Ivan Zhakov wrote: >> I've implemented proposed behavior in r1653032. >> >> On 18 January 2015 at 06:48, Daniel Shahaf wrote: >>> It would be nice if the the logged message should be different in that >>> case, too. That is:

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-20 Thread Branko Čibej
On 19.01.2015 18:10, Ivan Zhakov wrote: > I've implemented proposed behavior in r1653032. > > On 18 January 2015 at 06:48, Daniel Shahaf wrote: >> It would be nice if the the logged message should be different in that >> case, too. That is: there should be some indication, besides the >> differen

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-19 Thread Ivan Zhakov
I've implemented proposed behavior in r1653032. On 16 January 2015 at 22:52, C. Michael Pilato wrote: [...] > > As for log levels, is there any reason to log the implicit read attempts > at a level higher than "debug"? I have no opinion about the log level > for the explicit ones. > Some audit t

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-17 Thread Daniel Shahaf
Ben Reser wrote on Fri, Jan 16, 2015 at 14:09:45 -0800: > On 1/16/15 11:52 AM, C. Michael Pilato wrote: > > As for log levels, is there any reason to log the implicit read attempts > > at a level higher than "debug"? I have no opinion about the log level > > for the explicit ones. > > I can see s

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread Ben Reser
On 1/16/15 11:52 AM, C. Michael Pilato wrote: > As for log levels, is there any reason to log the implicit read attempts > at a level higher than "debug"? I have no opinion about the log level > for the explicit ones. I can see some people possibly wanting this information for auditing purposes.

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread Branko Čibej
On 16.01.2015 20:52, C. Michael Pilato wrote: > On 01/16/2015 02:18 PM, Ivan Zhakov wrote: >> But I'm not sure that current behavior is the best. I'm thinking to >> implement the following logic in mod_authz_svn: use different log >> level whether access denied for subrequest or for primary request

Re: Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread C. Michael Pilato
On 01/16/2015 02:18 PM, Ivan Zhakov wrote: > But I'm not sure that current behavior is the best. I'm thinking to > implement the following logic in mod_authz_svn: use different log > level whether access denied for subrequest or for primary request (the > URL user actually tried to access). > > Doe

Logging of subrequest authorization checks in mod_dav_svn/mod_authz_svn

2015-01-16 Thread Ivan Zhakov
When doing operations like 'svn log' or 'svn ls' Subversion hides paths that are unreadable for user. I.e. if repository contains the following directories: /public /private And authorization file looks like this: [/] * = r [/private] * = Then 'svn ls REPOROOT' command will return only /public d