444430 - SVN commits need to work with passwords

Status: RESOLVED FIXED

(Webtools Graveyard :: Verbatim, defect)

Description

[Dan Schafer [:dschafer]]

For committing to SVN repositories requiring passwords, committing will require access to the user's authentication information.  Hence, the username and password will either need to be prompted for in the web interface or stored securely.

Comment 1

[Wil Clouser [:clouserw]]

The plan for this is detailed here:  http://wiki.mozilla.org/Verbatim:Interaction_with_SVN

Happy to hear feedback.

Comment 2

[Dan Schafer [:dschafer]]

Recently, translate toolkit had its commit() function modified to allow author flags; the original modification did not support SVN (it was designed to allow the use of --author flags for GIT, etc.).

I proposed a patch here to add SVN support:
http://tinyurl.com/5ug4yz
This would set the revision property pootle:author to the real author of the file.  if the patch ends up in translate-toolkit, this will effectively take care of the Verbatim side of this bug.

Comment 3

[Dan Schafer [:dschafer]]

A version of that patch landed in revision 7847 of the translate toolkit, and revision 7844 of mozootle merged the new author code in pootle trunk to mozootle.  Using the latest revision of mozootle and translate toolkit will lead to the property "translate:author" being set to the username who commits the change.

Comment 4

[Dan Schafer [:dschafer]]

Attachment: Post-commit update author script

This isn't what we originally had in mind, but it seems to work: a post-commit script that replaces svn:author with translate:author.

This is in revision 7864.

Comment 5

[Dan Schafer [:dschafer]]

A working precommit/postcommit script now exists for the AMO demo, which will commit a file and convert the author successfully.  I won't close this, but I'm removing the priority tag from it.

Comment 6

[Wil Clouser [:clouserw]]

Talked about it briefly yesterday but so we don't forget:

For the mozilla script we should modify it to accept a list of IPs to accept commits from and only recognize the translate:author flag if they come from those IPs.  

We also need to document the potential security issues here (allowing people to specify the authors) so anyone else using it can take appropriate steps for their systems.

Comment 7

[Dan Schafer [:dschafer]]

Attachment: Sample pre-revprop-change hook

This is a sample pre-revprop-change hook; it allows log modifications by anyone, and allows svn:author changes by a single user, specified by SERVERUSER.

Comment 8

[Dan Schafer [:dschafer]]

If we want to reject spoofed translate:author flags, we could set up a pre-commit hook (similar to this, maybe: http://svn.collab.net/repos/svn/trunk/contrib/hook-scripts/pre-commit-check.py) that only accepts a commit with translate:author set if it meets certain conditions (i.e. committing user is SERVERUSER).

Comment 9

[Wil Clouser [:clouserw]]

Using a username instead of IPs is fine with me.

Comment 10

[Wil Clouser [:clouserw]]

Attachment: new post-commit patch

New post-commit patch

Comment 11

[Wil Clouser [:clouserw]]

Attachment: new pre-revprop-change

Comment 12

[Wil Clouser [:clouserw]]

Attachment: pre-commit

Turns out pre-revprop-change doesn't actually care about properties you've already set.  So, here is a pre-commit script that does the job instead.

Comment 13

[Wil Clouser [:clouserw]]

Attachment: post-commit using svn:log instead of translate:author

Comment 14

[Wil Clouser [:clouserw]]

Attachment: pre-revprop-change without translate:author

Comment 15

[Wil Clouser [:clouserw]]

Attachment: post-commit without translate:author

Comment 16

[Wil Clouser [:clouserw]]

Attachment: *sigh*

So, this is not my night.  Long story short, the SVN version I was testing with was too old to have --with-revprop so things were breaking and I made a version using svn:log.  Turns out I didn't need to and this works fine.  I hope this resolves the bug and I never see it again. <3