[SVN-2388] Repository could be modified without write access.

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.2.x
• Fix Version/s: 1.3.0
• Component/s: libsvn_ra_neon
• Assignee: Unassigned
• Reporter: Subversion Importer
• Created: 26/Aug/05 16:18
• Updated: 27/Oct/18 16:34
• Resolved: 10/Mar/09 15:22

Description

Hello,

I found the following security issue with DAV repository access. Below is
JavaSVN code:

SVNRepository repos = SVNRepositoryFactory.createRepository(...);
ISVNEditor editor = repos.getCommitEditor("message", null);
editor.openRoot(-1);
editor.closeEdit();

In the above code no exception is thrown, and repository revision goes up after
commit. User do not have write access to repository, only RO access. Adding
editor.addFile(...) call causes auth exception to be thrown.

Tested with Subversion repository 1.2.1, but it is not reproducible with
Subversion repository at svn.collab.net. Probably MKACTIVITY requires
authentication with some apache servers/configurations and does not require it
with others.

My apache configuration is:

        <Location /svn/repos>
                DAV svn
                SVNParentPath /var/svn/repos

                AuthzSVNAccessFile conf/svn-access

                Satisfy Any
                Require valid-user

                AuthType Basic
                AuthName "Subversion repository"
                AuthUserFile conf/svn-passwd
        </Location>

svn-access file:

[/]
* = r
user0 = rw
user1 = rw
user2 = rw

Original issue reported by oka