X-Original-To: pgsql-www-postgresql.org@localhost.postgresql.org Received: from localhost (unknown [200.46.204.2]) by svr1.postgresql.org (Postfix) with ESMTP id 1BC51D1B4D2; Wed, 11 Feb 2004 16:15:31 +0000 (GMT) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (neptune.hub.org [200.46.204.2]) (amavisd-new, port 10024) with ESMTP id 75691-10; Wed, 11 Feb 2004 12:15:17 -0400 (AST) Received: from sss.pgh.pa.us (unknown [192.204.191.242]) by svr1.postgresql.org (Postfix) with ESMTP id 1B42DD1DCF3; Wed, 11 Feb 2004 12:15:18 -0400 (AST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.12.11/8.12.11) with ESMTP id i1BGFGHH021454; Wed, 11 Feb 2004 11:15:17 -0500 (EST) To: Robert Treat Cc: "Marc G. Fournier" , pgsql-www@postgresql.org Subject: Re: things currently broken/missing In-reply-to: <1076514410.17920.94.camel@camel> References: <1076509856.18024.90.camel@camel> <20040211110619.D40659@ganymede.hub.org> <1076514410.17920.94.camel@camel> Comments: In-reply-to Robert Treat message dated "11 Feb 2004 10:46:50 -0500" Date: Wed, 11 Feb 2004 11:15:16 -0500 Message-ID: <21453.1076516116@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by amavisd-new at postgresql.org X-Archive-Number: 200402/57 X-Sequence-Number: 3622 Robert Treat writes: > On Wed, 2004-02-11 at 10:19, Marc G. Fournier wrote: >> Odd ... I just disabled it ... why would we want that ability enabled: >> >> # allow annotation of files >> # this requires rw-access to the >> # CVSROOT/history - file and rw-access >> # to the subdirectory to place the lock >> # so you maybe don't want it >> >> sounds to me like anyone with a web browser can write to CVS? > thats not what its supposed to do, though it does sound like thats what > it does from the instructions you've pasted. what its supposed to do is > give you a a breakdown of file changes per version, similar to this: > http://www.freebsd.org/cgi/cvsweb.cgi/ports/www/urchin5/Makefile?annotate=1.2 I think we probably ought to leave this turned off. From a security standpoint, it would scare me quite a lot for the cgi user to have write access to the CVS tree. Even though the annotation software itself may do nothing more risky than temporarily locking files, what of bugs that might allow someone to make more extensive changes? The annotation display is kind of nice, but it doesn't strike me as useful enough to be worth taking any risks for. The people who are likely to need it all have local CVS copies and can just run "cvs anno" when they need it. (But then, I only find a use for this maybe a couple times a year. Perhaps other people depend on it more?) regards, tom lane