Comments on: Serving websites from svn checkout considered harmful

By: Alex

Alex — Mon, 18 Jan 2010 00:07:12 +0000

stupid russian idiots published this news 1 year after you…))

rtw — Thu, 12 Mar 2009 19:27:42 +0000

i’ve been messing around with my lighttpd regex patterns trying to solve this issue –

$HTTP["url"] =~ ".*\.svn.*" { url.access-deny = ("") }

still allows me to access/download the /.svn/entries and /.svn/format files, but protects the directory. Anyone else have similar results?

p.s. – i’m actually planning on using:

url.redirect-code = 404

instead of
#url.access-deny = ("")

I believe this is a better strategy – that way you’re denying that the files are even there. The equivalent in Apache is:

RedirectMatch 404 /\\.svn(/|$)

(the apache directive protects the entries and format files)

Any help is appreciated!!

Jason — Fri, 19 Dec 2008 01:27:28 +0000

I use darcs rather than svn for my webpage, and noticed the darcs equivalent to this a few months ago. It’s a problem with most VC systems.

Jonathan — Sun, 26 Oct 2008 14:09:28 +0000

Wow! Thanks for opening my eyes on this.

I’m so surprised that this isn’t a well-known issue for web developers using subversion.

I just sent your article out to a bunch of colleagues.
Thanks again,
Jonathan