Attachment 717972 Details for Bug 929090 – patch-against-1.6.20

[patch] patch-against-1.6.20

CVE-2013-1846+1847-patch-against-1.6.20.patch (text/plain), 2.19 KB, created by Huzaifa S. Sidhpurwala on 2013-03-29 08:52:06 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Huzaifa S. Sidhpurwala

Created: 2013-03-29 08:52:06 UTC

Size: 2.19 KB

patch

obsolete

>Index: subversion/mod_dav_svn/lock.c
>===================================================================
>--- subversion/mod_dav_svn/lock.c	(revision 1459696)
>+++ subversion/mod_dav_svn/lock.c	(working copy)
>@@ -634,7 +634,20 @@ append_locks(dav_lockdb *lockdb,
>   svn_lock_t *slock;
>   svn_error_t *serr;
>   dav_error *derr;
>+  dav_svn_repos *repos = resource->info->repos;
>+      
>+  /* We don't allow anonymous locks */
>+  if (! repos->username)
>+    return dav_new_error(resource->pool, HTTP_UNAUTHORIZED,
>+                         DAV_ERR_LOCK_SAVE_LOCK,
>+                         "Anonymous lock creation is not allowed.");
> 
>+  /* Not a path in the repository so can't lock it. */
>+  if (! resource->info->repos_path)
>+    return dav_new_error(resource->pool, HTTP_BAD_REQUEST,
>+                         DAV_ERR_LOCK_SAVE_LOCK,
>+                         "Attempted to lock path not in repository.");
>+
>   /* If the resource's fs path is unreadable, we don't allow a lock to
>      be created on it. */
>   if (! dav_svn__allow_read_resource(resource, SVN_INVALID_REVNUM,
>@@ -657,7 +670,6 @@ append_locks(dav_lockdb *lockdb,
>       svn_fs_txn_t *txn;
>       svn_fs_root_t *txn_root;
>       const char *conflict_msg;
>-      dav_svn_repos *repos = resource->info->repos;
>       apr_hash_t *revprop_table = apr_hash_make(resource->pool);
>       apr_hash_set(revprop_table, SVN_PROP_REVISION_AUTHOR,
>                    APR_HASH_KEY_STRING, svn_string_create(repos->username,
>@@ -734,7 +746,7 @@ append_locks(dav_lockdb *lockdb,
> 
>   /* Convert the dav_lock into an svn_lock_t. */
>   derr = dav_lock_to_svn_lock(&slock, lock, resource->info->repos_path,
>-                              info, resource->info->repos->is_svn_client,
>+                              info, repos->is_svn_client,
>                               resource->pool);
>   if (derr)
>     return derr;
>@@ -741,7 +753,7 @@ append_locks(dav_lockdb *lockdb,
> 
>   /* Now use the svn_lock_t to actually perform the lock. */
>   serr = svn_repos_fs_lock(&slock,
>-                           resource->info->repos->repos,
>+                           repos->repos,
>                            slock->path,
>                            slock->token,
>                            slock->comment,

Actions: View | Diff

Attachments on bug 929090: 717972 | 717973