Re: Expansion of authz policy name leak (was: svn commit: r933194 - /subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c)

2010-04-12 Thread Peter Samuelson
[C. Michael Pilato] > IIUC, prior to your change, nobody who had enabled authz at all could > make use of the SVNListParentPath feature (because the authorization > for that display would systematically fail). But this also means > that Subversion never leaked the name of a repository that was >

RE: Expansion of authz policy name leak (was: svn commit: r933194 - /subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c)

2010-04-12 Thread Kamesh Jayachandran
>IIUC, prior to your change, nobody who had enabled authz at all could make >use of the SVNListParentPath feature (because the authorization for that >display would systematically fail). But this also means that Subversion >never leaked the name of a repository that was intended to be private/hidd

Expansion of authz policy name leak (was: svn commit: r933194 - /subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c)

2010-04-12 Thread C. Michael Pilato
Kamesh Jayachandran wrote: >> I would expect that a request to the parent directory would yield a >> listing >> that included the 'calc' and 'watch' repositories, but not the 'lamp' >> one. >> >> Is that the case? >> >> > No. > > These authz rule should *not* list anything inside the repo 'lam

Re: svn commit: r933194 - /subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c

2010-04-12 Thread Kamesh Jayachandran
On 04/12/2010 07:49 PM, C. Michael Pilato wrote: kame...@apache.org wrote: Author: kameshj Date: Mon Apr 12 11:26:28 2010 New Revision: 933194 URL: http://svn.apache.org/viewvc?rev=933194&view=rev Log: [issue2753] Fix issue 2753. Relax requests aimed at the repo Parent path from authz cont

Re: svn commit: r933194 - /subversion/trunk/subversion/mod_authz_svn/mod_authz_svn.c

2010-04-12 Thread C. Michael Pilato
kame...@apache.org wrote: > Author: kameshj > Date: Mon Apr 12 11:26:28 2010 > New Revision: 933194 > > URL: http://svn.apache.org/viewvc?rev=933194&view=rev > Log: > [issue2753] Fix issue 2753. > > Relax requests aimed at the repo Parent path from authz control. > > * subversion/mod_authz_svn/m