In 1.9 it was possible to repeat, or reopen, a section: [/some/path] user = r [/some/path] otheruser = rw
This was equivalent to a single section: [/some/path] user = r otheruser = rw In 1.10 this is rejected by the parser and cannot be used. Is this a bug in 1.10 or an acceptable behaviour change? In 1.9 any repeat acl lines that were the exact same match, such as: [/some/path] user = rw user = r resulted in the last line overriding all the other lines, so user=r in the example above. In 1.10 the lines combine, so user=rw in the example above. Is this a bug in 1.10, or a bug in 1.9 that is fixed in 1.10, or an acceptable behaviour change? Finally, issue 4762. In 1.9 if both global and per-repository sections matched they were combined, so: [/some/path] user = rw [repos:/some/path] user = r resulted in user=rw. The issue 4762 problem is that in 1.10 the per-repository section overrides any global section, so user=r above. I believe this is a 1.10 bug and that the 1.9 behaviour should be reinstated. However, consider glob rules: [:glob:/some/*] user = rw [:glob:repos:/some/*] user = r At present the per-repository section override the global section just like the buggy behaviour for non-glob sections. If we fix 4762 to reinstate the combining for non-glob sections should we change the behaviour of glob sections so they combine as well? What about a non-glob and glob section: [/some/path] user = rw [:glob:repos:/some/path] user = r Should these combine? Glob sections are new so they could have different behaviour from non-glob sections, but is that what we want? There is a wiki page https://cwiki.apache.org/confluence/display/SVN/AuthzImprovements but given issue 4762 I not sure whether it describes the correct behaviour. -- Philip
