Index: lib/viewvc.py
===================================================================
--- lib/viewvc.py (revision 1665)
+++ lib/viewvc.py (working copy)
@@ -3087,12 +3087,15 @@
if not cvs:
generate_tarball_header(out, tar_dir, mtime=dir_mtime)
- # Run through the files in this directory, skipping busted ones.
+ # Run through the files in this directory, skipping busted and
+ # unauthorized ones.
for file in entries:
if file.kind != vclib.FILE:
continue
if cvs and (file.rev is None or file.dead):
continue
+ if not request.auth.check_path_access(_path_parts(file.name)):
+ continue
# If we get here, we've seen at least one valid file in the
# current directory. For CVS, we need to make sure there are
@@ -3119,17 +3122,16 @@
out.write(contents)
out.write('\0' * (511 - ((len(contents) + 511) % 512)))
- # Recurse into subdirectories, skipping busted ones.
+ # Recurse into subdirectories, skipping busted and unauthorized (or
+ # configured-to-be-hidden) ones.
for file in entries:
if file.errors or file.kind != vclib.DIR:
continue
-
- # Skip forbidden/hidden directories (top-level only).
if not rep_path:
- if (not request.auth.check_path_access(_path_parts(file.name))
- or (cvs and request.cfg.options.hide_cvsroot
- and file.name == 'CVSROOT')):
+ if cvs and request.cfg.options.hide_cvsroot and file.name == 'CVSROOT'):
continue
+ if not request.auth.check_path_access(_path_parts(file.name)):
+ continue
mtime = request.roottype == 'svn' and file.date or None
generate_tarball(out, request, reldir + [file.name], stack, mtime)