upgraded from 2.3.3-3.1 to 2.8.7 / using multiple useAuthenticationFile-directives does not work anymore

[Starfish4711git]

Hi,

I hope this is the right place to ask this this question, but I did not find any other.

We have been using WebSVN up to version 2.3.3 for years and now we had to upgrade to a more current version, because of PHP7 being deprecated.

We are using 3 local parent directories wherein the repositories are placed, accordingly there are 3 parentpath-directives within our config.php file, like this:
$config->parentPath('/data1/svn/repobase/xxx/data', 'groupx');
$config->parentPath('/data1/svn/repobase/yyy/data', 'groupy');
$config->parentPath('/data1/svn/repobase/zzz/data', 'groupz');

Each of this parent directories is using its own svnauthz.conf file, therefor we had lines like these:
$config->useAuthenticationFile('/data1/svn/repobase/xxx/permissions/svnauthz.conf');
$config->useAuthenticationFile('/data1/svn/repobase/yyy/permissions/svnauthz.conf');
$config->useAuthenticationFile('/data1/svn/repobase/zzz/permissions/svnauthz.conf');

First of all I noticed that naming has been changed in the meantime and I had to replace "useAuthenticationFile" with "useAccessFile".

Now configuration is accepted, but WebSVN does not show all 3 repo bases anymore, but only the one of the latest "useAuthenticationFile" directive. If I change the order or comment out later directives, the last active directive "wins".

How do I get back the original behavior? Is there some additional configuration I have to adjust, is it a bug, is it intended that way?

Thanks in advance!

[michael-o]

Puh, the has been to many versions in between. The crucial change is that the authentication is handled by the web server only and the authz file uses svnauthz. I need to check. I bet the access file is global.

[Starfish4711git]

Any findings yet?

[michael-o]

Any findings yet?

No, not yet, but 2.3.3 is extremely old. Too many changes have happened. Maybe you could upgrade incrementally and find the first failing version?

[michael-o]

While looking into this, I noticed useAccessFile() is actually misnamed relative to the rest of this config class's conventions (it only ever assigns a single path, same shape as setSvnCommandPath()/setDiffPath()/etc., not a feature-toggle like useMultiViews()/useTreeView()). I've renamed it to setAccessFile(), with useAccessFile() kept as a deprecated alias for backward compatibility — no behavior change, just a naming cleanup. That's a side fix only; it doesn't resolve this issue on its own.

Looking at what you're actually trying to do — one access file per parentPath() group (groupx, groupy, groupz), each scoped to just that group's repositories — there's currently no way to do that safely. Calling the global useAccessFile()/setAccessFile() multiple times just overwrites the previous call (last one wins), and even if it didn't, a single global file can't correctly serve multiple groups anyway: svnauthz only ever sees a bare repository name with no group context, so if two of your groups happen to contain a same-named repository, there'd be no way to tell their rules apart.

Before I build anything: would a per-group access file — overriding the global one for repositories in that group — actually solve what you're after? Concretely, something like a $accessFile parameter on parentPath() itself:

$config->parentPath('/data1/svn/repobase/xxx/data', 'groupx', false, true, '', '/data1/svn/repobase/xxx/permissions/svnauthz.conf');

so that every repository discovered under that parent path is checked exclusively against that group's own file, falling back to the global file (if any) only for groups that don't specify one. Let me know if that matches your use case, or if you had something else in mind.