News for hackers. Stuff that matters.
Re:Hacking the .SVN directory by miratom on Monday January 26, 2009 @11:27PM (#451653)
Why are you pushing files with rsync with a working copy? That is what "export" is for. There is no special security in the .svn folder, because you are not supposed to publish it to the website.
Re:Hacking the .SVN directory by agotterer on Monday January 26, 2009 @11:34PM (#451662)
To be perfectly honest I'm not sure if its an rsync or a checkout. I'm not the sys admin or the person who set up the process. But doing an export makes sense, that was something I was thinking about after I discovered this. Thanks for the confirmation.

Regardless, this problem exists and it exists on some extremely large websites.

Re:Hacking the .SVN directory by joeyo on Tuesday January 27, 2009 @12:47AM (#451721)
You seem to have made a mistake with the rewrite rule. I think you mean:

  RewriteRule (\.svn)/(.*?) - [F,L]
Note the backslash before the .svn directory.

I'm also not entirely sure that the question mark (zero or one quantifier) is necessary; it seems like

  (.*)
would suffice for catching files within the .svn directory, but this is quickly getting out of my league.
Re:Hacking the .SVN directory by agotterer on Tuesday January 27, 2009 @01:09AM (#451736)
Your right, I forget to transcribe the backslash (its correct in my htaccess). I will update the article. Thanks!
Re:Hacking the .SVN directory by agotterer on Tuesday January 27, 2009 @10:28AM (#452207)
I mentioned this to our sys admin. He made a good point... Export will copy every file in the repository over, every time. Our repo is quite large and we push often. We use rsync so it only copies the most recent changes. They also go out to a number of servers.
Re:Hacking the .SVN directory by brianr on Tuesday January 27, 2009 @04:11AM (#451846)
rsync is fine, just make sure to exclude .svn and anything else you don't want the world to see, for example:

  cd $build_dir
  svn co path/to/project
  rsync -qaz -c --delete --exclude=.svn project $host:/var/www
Re:Hacking the .SVN directory by dreur on Tuesday January 27, 2009 @06:55AM (#451987)
+1