FineGrainedPermissions using module and Scoped Repository doesn't work

[M.v.Kalmthout_1@…]

Testcase: In Trac.ini

[trac]
repository_dir = D:/SVN_REPOSITORY/MBB/common
authz_file = D:/SVN_REPOSITORY/svnaccessfile 
authz_module_name = MBB

And in svnaccessfile

#access to SomeDir is NOT blocked by TRAC
[MBB:/common/SomeDir]
@all-sw-developers =

but leaving out the subset does the job.

#access to SomeDir is blocked 
[MBB:/SomeDir]
@all-sw-developers =

[Matthew Good]

Yes, I noticed this same issue looking at #2453.

[M.v.Kalmthout_1@…]

auth_paths.patch corrected

[anonymous]

I am not sure this is the (best) way to solve it. It solved the problem for me.

[M.v.Kalmthout_1@…]

In source:branches/0.10-stable@4310​ I still encounter this (or similar) problem.

I found 3 things which seem incorrect to me

• posixpath.join(self.scope, path) removes the scope if path has a leading / ( source:branches/0.10-stable/trac/versioncontrol/svn_fs.py@4310#352​ )
• path in self.authz.has_permission(path) must be full path so including the scope ( source:branches/0.10-stable/trac/versioncontrol/svn_fs.py@4310#576​ )
• path in self.has_permission(path) must also be a full path as while the changesets contain 'path's within the scope' ( source:branches/0.10-stable/trac/versioncontrol/svn_authz.py@4310#98​ )

I will attach a patch which I used to find and hopefully solve this.

[M.v.Kalmthout_1@…]

I think these are bugs which should be 'patched'. Just let me know if I have to do some rework or something else to get this patch accepted. (this is the only Python code I ever wrote so don't expect too much.)

[Christian Boos]

Right, sorry if that went unnoticed, we have so many tickets ;)

mgood, do you still want to take care of this one? If not, I can take the ticket.

[Matthew Good]

make repositories include the scope when checking authz permissions

[Matthew Good]

There was some inconsistency since some of the SVN methods included the scope while others didn't, so attachment:scope-auth.diff should address this. We should probably have some unit tests for this too.

[Christian Boos]

#3192 and #3489 are potential duplicates of this one.

[Christian Boos]

I meant #4389.

[M.v.Kalmthout_1@…]

Replying to mgood:

There was some inconsistency since some of the SVN methods included the scope while others didn't,

I noticed the inconsistency too.

However the problem was not only caused by this inconsistency but also by the posixpath.join(self.scope, path) construction.

Example: if scope='/subdir' and path='/' the result of posixpath.join is '/' and NOT '/subdir/'

[Christian Boos]

#5065 was closed as duplicate.

[Christian Boos]

Should be fixed by r5245 (trunk).

I started by applying mgood's patch, then added the path.strip('/') in the places that needed it, as this was necessary as M.v.Kalmthout pointed out.

[Christian Boos]

Ported to 0.10-stable in r5246.