366781 - cvs-mirror.nl.mozilla.com allows anonymous write access

Status: VERIFIED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[:Gavin Sharp [email: [e-mail]]]

Hannibal discovered this accidentally when trying to check in the patch for bug 364611.

Run the following command:
cvs -d :pserver:[e-mail]:/cvsroot ci -fm "test" mozilla/configure.in

Expected results:
cvs [server aborted]: "commit" requires write access to the repository

Actual results:
Checking in configure.in;
/cvsroot/mozilla/configure.in,v  <--  configure.in
new revision: 1.1760; previous revision: 1.1759
done

This doesn't appear to be an issue on cvs-mirror.sj.mozilla.com.

Comment 1

[:Gijs (he/him)]

I don't think it actually works. I just tried checking out browser.js, which was modified by me according to the checkin message, but cvs log showed all cvs-mirror knew about was revision 1.750, which is the one before my "checkin". Or maybe it's been resynced, I suppose that could explain why the change is no longer there... I'm confused. But I have to run for class right now.

Comment 2

[:Gavin Sharp [email: [e-mail]]]

Yeah, it syncs pretty frequently, so your checkin from yesterday has already disappeared. My recent checkin of configure.in is still there at the moment, though.

Comment 3

[Jeremy Orem [:oremj]]

It probably checks in then gets overwritten by the new rsync, however, this is a pretty big problem since commits would be live on the mirror for up to 20 min or so.

Comment 4

[Jeremy Orem [:oremj]]

This should be fixed now.  Let me know if anyone can still commit.