← Back to branch summary

~ubuntu-branches/debian/sid/subversion/sid

« back to all changes in this revision

Viewing changes to subversion/mod_dav_svn/authz.c

  • Committer: Package Import Robot
  • Author(s): James McCoy
  • Date: 2015-08-07 21:32:47 UTC
  • mfrom: (0.2.15) (4.1.7 experimental)
  • Revision ID: package-import@ubuntu.com-20150807213247-ozyewtmgsr6tkewl
Tags: 1.9.0-1
http://bugs.debian.org/791844
* Upload to unstable
* New upstream release.
  + Security fixes
    - CVE-2015-3184: Mixed anonymous/authenticated path-based authz with
      httpd 2.4
    - CVE-2015-3187: svn_repos_trace_node_locations() reveals paths hidden
      by authz
* Add >= 2.7 requirement for python-all-dev Build-Depends, needed to run
  tests.
* Remove Build-Conflicts against ruby-test-unit.  (Closes: #791844)
* Remove patches/apache_module_dependency in favor of expressing the
  dependencies in authz_svn.load/dav_svn.load.
* Build-Depend on apache2-dev (>= 2.4.16) to ensure ap_some_authn_required()
  is available when building mod_authz_svn and Depend on apache2-bin (>=
  2.4.16) for runtime support.

Show diffs side-by-side

added added

removed removed

Lines of Context:
subversion/mod_dav_svn/authz.c
57
57
  /* Sometimes we get paths that do not start with '/' and
58
58
     hence below uri concatenation would lead to wrong uris .*/
59
59
  if (path && path[0] != '/')
60
 
    path = apr_pstrcat(pool, "/", path, NULL);
 
60
    path = apr_pstrcat(pool, "/", path, SVN_VA_NULL);
61
61
 
62
62
  /* If bypass is specified and authz has exported the provider.
63
63
     Otherwise, we fall through to the full version.  This should be
80
80
    uri_type = DAV_SVN__BUILD_URI_PUBLIC;
81
81
 
82
82
  /* Build a Version Resource uri representing (rev, path). */
83
 
  uri = dav_svn__build_uri(repos, uri_type, rev, path, FALSE, pool);
 
83
  uri = dav_svn__build_uri(repos, uri_type, rev, path, FALSE /* add_href */,
 
84
                           pool);
84
85
 
85
86
  /* Check if GET would work against this uri. */
86
87
  subreq = ap_sub_req_method_uri("GET", uri, r, r->output_filters);