1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
|
#!/usr/bin/env python
#
# iprop_authz_tests.py: iprop tests that need to write an authz file
#
# Subversion is a tool for revision control.
# See http://subversion.apache.org for more information.
#
# ====================================================================
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
######################################################################
# General modules
import os
# Our testing module
import svntest
# (abbreviation)
Skip = svntest.testcase.Skip_deco
from svntest.main import write_restrictive_svnserve_conf
from svntest.main import write_authz_file
######################################################################
# Tests
#----------------------------------------------------------------------
# Property inheritance with read restrictions on parent paths.
@Skip(svntest.main.is_ra_type_file)
def iprops_authz(sbox):
"property inheritance and read restricted parents"
sbox.build()
wc_dir = sbox.wc_dir
# r2 - Set properties at various levels.
sbox.simple_propset('RootProp', 'Root-Prop-Val', '.')
sbox.simple_propset('BranchProp', 'Branch-Prop-Val', 'A')
sbox.simple_propset('RandomProp1', 'Random-Prop-Val-1', 'A/D')
sbox.simple_propset('RandomProp2', 'Random-Prop-Val-2', 'A/D/H')
sbox.simple_propset('FileProp1', 'File-Prop-Val-1', 'A/D/H/psi')
svntest.main.run_svn(None, 'commit', '-m', 'Add some properties',
wc_dir)
write_restrictive_svnserve_conf(sbox.repo_dir)
# Check that a restricted user can only see inherited props from
# parent paths which he has read access to.
# Grant access only to ^/A/D/H/psi. No inherited properties should
# be shown.
write_authz_file(sbox, {
"/A/D/H/psi" : svntest.main.wc_author + "=rw",})
expected_iprops = {}
expected_explicit_props = {'FileProp1' : 'File-Prop-Val-1'}
svntest.actions.run_and_verify_inherited_prop_xml(
sbox.repo_url + '/A/D/H/psi', expected_iprops, expected_explicit_props)
# Grant access to ^/A/D/H/psi and the repos root but not the intermediate
# paths between the two.
write_authz_file(sbox, {
"/" : svntest.main.wc_author + "=rw",
"/A" : svntest.main.wc_author + "=",
"/A/D/H/psi" : svntest.main.wc_author + "=rw",})
expected_iprops = {
sbox.repo_url : {'RootProp' : 'Root-Prop-Val'}}
svntest.actions.run_and_verify_inherited_prop_xml(
sbox.repo_url + '/A/D/H/psi', expected_iprops, expected_explicit_props)
# Grant access to ^/A/D/H/psi, the repos root, and the intermediate path
# ^/A/D. Everything else is still blocked.
write_authz_file(sbox, {
"/" : svntest.main.wc_author + "=rw",
"/A" : svntest.main.wc_author + "=",
"/A/D" : svntest.main.wc_author + "=rw",
"/A/D/H" : svntest.main.wc_author + "=",
"/A/D/H/psi" : svntest.main.wc_author + "=rw",})
expected_iprops = {
sbox.repo_url : {'RootProp' : 'Root-Prop-Val'},
sbox.repo_url + '/A/D': {'RandomProp1' : 'Random-Prop-Val-1'}}
svntest.actions.run_and_verify_inherited_prop_xml(
sbox.repo_url + '/A/D/H/psi', expected_iprops, expected_explicit_props)
# Grant read access to everything except ^/A/D/H/psi. In this case we
# should get an authorization failed error. It doesn't matter that we can
# read the parents.
write_authz_file(sbox, {
"/" : svntest.main.wc_author + "=rw",
"/A/D/H/psi" : svntest.main.wc_author + "=",})
if sbox.repo_url.startswith("http"):
expected_err = ".*[Ff]orbidden.*"
else:
expected_err = ".*svn: E170001: Authorization failed.*"
svntest.actions.run_and_verify_svn(
None, None, expected_err, 'proplist', '-v',
'--show-inherited-props', sbox.repo_url + '/A/D/H/psi')
########################################################################
# Run the tests
# list all tests here, starting with None:
test_list = [ None,
iprops_authz,
]
serial_only = True
if __name__ == '__main__':
svntest.main.run_tests(test_list)
# NOTREACHED
### End of file.
|
