Uploaded image for project: 'Subversion'
  1. Subversion
  2. SVN-2388

Repository could be modified without write access.

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 1.2.x
    • Fix Version/s: 1.3.0
    • Component/s: libsvn_ra_neon
    • Labels:
      None

      Description

      Hello,
      
      I found the following security issue with DAV repository access. Below is
      JavaSVN code:
      
      SVNRepository repos = SVNRepositoryFactory.createRepository(...);
      ISVNEditor editor = repos.getCommitEditor("message", null);
      editor.openRoot(-1);
      editor.closeEdit();
      
      In the above code no exception is thrown, and repository revision goes up after
      commit. User do not have write access to repository, only RO access. Adding
      editor.addFile(...) call causes auth exception to be thrown.
      
      Tested with Subversion repository 1.2.1, but it is not reproducible with
      Subversion repository at svn.collab.net. Probably MKACTIVITY requires
      authentication with some apache servers/configurations and does not require it
      with others.
      
      My apache configuration is:
      
              <Location /svn/repos>
                      DAV svn
                      SVNParentPath /var/svn/repos
      
                      AuthzSVNAccessFile conf/svn-access
      
                      Satisfy Any
                      Require valid-user
      
                      AuthType Basic
                      AuthName "Subversion repository"
                      AuthUserFile conf/svn-passwd
              </Location>
      
      svn-access file:
      
      [/]
      * = r
      user0 = rw
      user1 = rw
      user2 = rw
      

      Original issue reported by oka

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              subversion-importer Subversion Importer
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: