Skip to content

"listing.php" fails to show files in restricted subdirs. #146

@ams-tschoening

Description

@ams-tschoening

I'm somewhat sure there's something wrong with the following lines in listing.php:

    $vars['compare_box'] = ''; // Set blank once in case tree view is not enabled.
    return showDirFiles($svnrep, $subs, 0, $limit, $rev, $peg, $listing, 0, $config->treeView);

I'm calling that like the following, which is actually trying to show /tags/DIR1/DIR2:

https://[...]/websvn/Bin/DocBeam/listing.php?repname=DocBeam3&path=%2Ftags%2FDIR1%2FDIR2%2F

The important thing to note is that the executing users is NOT allowed to read /, /tags and /tags/DIR1, really only the last directory. And while WebSVN doesn't show any error, but instead the logs etc. of DIR2, it as well DOES NOT show the files WITHIN that directory.

I think providing 0 as the level in the above call in case of child paths is wrong. Doing so makes the called function showDirFiles always start with /, permission check for that dir correctly fails and no children are ever recognized.

    // TODO: Fix node links to use the path and number of peg revision (if exists)
    // This applies to file detail, log, and RSS -- leave the download link as-is
    for ($n = 0; $n <= $level; $n++)
    {
        $path .= $subs[$n].'/';
    }

$subs is correct when calling that code, but with$level being 0, there's only one iteration.

array(5) {[0]=>string(0) ""[1]=>string(4) "tags"[2]=>string(2) "BB"[3]=>string(9) "LSG BE-BB"[4]=>string(0) "" }

What does work is the following:

    // For directory, the last element in the subs is empty.
    // For file, the last element in the subs is the file name.
    // Therefore, it is always count($subs) - 2
    $limit = count($subs) - 2;
    $level = $limit - 1;
    $level = $level <= 0 ? 0 : $level;
[...]
    $vars['compare_box'] = ''; // Set blank once in case tree view is not enabled.
    return showDirFiles($svnrep, $subs, $level, $limit, $rev, $peg, $listing, 0, $config->treeView);

Would be great if someone else could have a look at this as well, thanks!

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions