905952 - update viewvc.svn.mozilla.org to 1.1.21

Status: RESOLVED WONTFIX

(Developer Services :: General, task)

Description

[David Weir (satdav)]

Attachment: Mozilla viewsvn

According to the viewsvn official site we are 2 versions out of date 1.1.20 is the latest version



http://viewvc.tigris.org/servlets/ProjectDocumentList?folderID=6004

Can we possible get this updated

Comment 1

[David Weir (satdav)]

Attachment: The viewsvn download page

Added the official download page screenshot

Comment 2

[:Atoll]

ViewVC CHANGES file containing 1.1.19 and 1.1.20:

http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?revision=HEAD

And their SVN's tag naming is "1.1.18", "1.1.19", and "1.1.20" for code review purposes.

Comment 3

[Michael Henry [:tinfoil]]

Thanks :atoll for the link to the relevant change logs

This looks like a fairly minor upgrade and I don't see anything in the chagelog that would drastically change the existing operational security of this application.  

(Note this is from an opsec perspective, not appsec)

Comment 4

[David Weir (satdav)]

Can you ask about getting this app security reviewed

Comment 5

[Jake Maul [:jakem]]

I haven't updated ViewVC personally, so I don't know how difficult this is.

We are planning to stop supporting SVN at some point, but probably not within a short timeframe, so my inclination is to leave this bug open.

Comment 6

[Michael Henry [:tinfoil]]

Didn't see the needinfo to me (corrected that issue, so it won't happen again)

:satdav - to request a security review see this page. https://wiki.mozilla.org/Security/Reviews/Review_Request_Form

That explains it better than I ever can.  :-)

Comment 7

[David Weir (satdav)]

have we got a update re if this has been updated yet on the test servers

Comment 8

[Ben Kero [:bkero]]

It's been determined that singe SVN is a deprecated system, we don't want to spend the engineering time and effort to put this change into production.