Jordan Peck <jordan.me2@gmail.com> (jpeck)

r1935663 | jpeck | 2026-06-26 15:10:09 +0000 (Fri, 26 Jun 2026)

Add myself to COMMITTERS

r1935828 | jpeck | 2026-07-03 10:42:05 +0000 (Fri, 03 Jul 2026)

Create branch for mod_dav_svn proxy fix for move/copy operations
See: https://lists.apache.org/thread/blwxmspvj4k97zdhhqs43sml39hmy04x

r1935830 | jpeck | 2026-07-03 11:11:39 +0000 (Fri, 03 Jul 2026)

Harden the DAV mirror tests in dav-mirror-autocheck.sh:

- Use distinct master/slave locations so the proxy actually translates paths

- Assert the decoded "branch new/" name in the master repo
rather than only checking commit exit status (a double-encoded
destination could otherwise pass silently)

- Drop the removed neon http-library option and libsvn_ra_neon from LD_LIBRARY_PATH

- Switch the exit-status checks to the "|| fail" idiom

r1935831 | jpeck | 2026-07-03 11:22:47 +0000 (Fri, 03 Jul 2026)

Fix mod_dav_svn write-through proxy mangling of COPY/MOVE Destination headers.
See: https://lists.apache.org/thread/blwxmspvj4k97zdhhqs43sml39hmy04x

When proxying a COPY or MOVE to the master, the Destination header still
pointed at the slave and was never translated, so cross-location commits
(and paths containing characters like spaces) failed or were mis-encoded.

Adds a new helper function proxy_request_fixup_destination() that rewrites
a request's destination header from the slave location to the master URI,
keeping the path encoded exactly once.

r1935843 | jpeck | 2026-07-03 14:35:34 +0000 (Fri, 03 Jul 2026)

Run dav-mirror-autocheck.sh (mod_dav_svn) tests in davautocheck.sh

r1935844 | jpeck | 2026-07-03 14:37:23 +0000 (Fri, 03 Jul 2026)

Add tests to dav-mirror-autocheck.sh to catch SVN-3445
Tests committing a file with:
- Master server URL: PASS
- Slave server URL: XFAIL

r1935857 | jpeck | 2026-07-03 18:48:06 +0000 (Fri, 03 Jul 2026)

Create branch for svnsync atomic author/timestamp when syncing to a file:// path
See discussion here: https://lists.apache.org/thread/qnxqd4whjp62rk2pgndt8xyp40oqnom2

r1935862 | jpeck | 2026-07-03 20:59:45 +0000 (Fri, 03 Jul 2026)

On the 'svnsync-atomic-author' branch:

Let svnsync set svn:author and svn:date in the commit itself when the
destination supports it, instead of patching them up with a post-commit
revprop change. This makes mirroring a revision atomic for ra_local
destinations and removes the window where a mirrored revision briefly
carries the wrong author and date.

See discussion: https://lists.apache.org/thread/qnxqd4whjp62rk2pgndt8xyp40oqnom2

Introduce SVN_RA_CAPABILITY_COMMIT_PRESERVES_AUTHOR_DATE, advertised by
ra_local and wired through the standard capability negotiation for svn://
and http:// so future servers can opt in without client changes. Rev the
repos-layer commit APIs to carry transaction flags (SVN_FS_TXN_CLIENT_DATE).

* subversion/include/svn_ra.h
  (SVN_RA_CAPABILITY_COMMIT_PRESERVES_AUTHOR_DATE): New capability.
  (svn_ra_get_commit_editor3): Allow svn:author/svn:date in REVPROP_TABLE
    when the session advertises the new capability.

* subversion/include/svn_ra_svn.h
  (SVN_RA_SVN_CAP_COMMIT_PRESERVES_AUTHOR_DATE): New wire capability.

* subversion/include/svn_dav.h
  (SVN_DAV_NS_DAV_SVN_COMMIT_PRESERVES_AUTHOR_DATE): New OPTIONS header token.

* subversion/include/svn_repos.h
  (svn_repos_get_commit_editor6, svn_repos_fs_begin_txn_for_commit3): New,
    taking TXN_FLAGS.
  (svn_repos_get_commit_editor5, svn_repos_fs_begin_txn_for_commit2):
    Deprecate.

* subversion/include/private/svn_repos_private.h
  (svn_repos__get_commit_ev2): Take TXN_FLAGS.

* subversion/libsvn_repos/commit.c
  (edit_baton): Add TXN_FLAGS.
  (open_root): Pass them to svn_repos_fs_begin_txn_for_commit3().
  (svn_repos_get_commit_editor6, svn_repos__get_commit_ev2): Accept and
    forward TXN_FLAGS.

* subversion/libsvn_repos/fs-wrap.c
  (svn_repos_fs_begin_txn_for_commit3): New revision of ..._commit2(),
    OR-ing TXN_FLAGS into SVN_FS_TXN_CHECK_LOCKS.
  (svn_repos_fs_begin_txn_for_commit): Move to deprecated.c.

* subversion/libsvn_repos/deprecated.c
  (svn_repos_get_commit_editor5, svn_repos_fs_begin_txn_for_commit2,
   svn_repos_fs_begin_txn_for_commit): Implement as wrappers.

* subversion/libsvn_ra_local/ra_plugin.c
  (prepare_commit_revprops): New helper: default svn:author to the session
    username only when absent, and request SVN_FS_TXN_CLIENT_DATE iff the
    caller supplied svn:date.
  (svn_ra_local__get_commit_editor, svn_ra_local__get_commit_ev2): Use it.
  (svn_ra_local__has_capability): Advertise the new capability.

* subversion/libsvn_ra_svn/client.c
  (ra_svn_has_capability): Map the new capability to its wire word.

* subversion/libsvn_ra_serf/options.c
  (capabilities_headers_iterator_callback, options_response_handler):
    Parse and pre-seed the new capability.

* subversion/mod_dav_svn/activity.c (dav_svn__create_txn),
  subversion/mod_dav_svn/lock.c (append_locks),
  subversion/svnserve/serve.c (commit):
    Track the API revs; no functional change.

* subversion/svnsync/svnsync.c
  (is_svnsync_prop): New helper.
  (replay_baton_t, resolve_revprop_handling): Resolve once per sync how
    revprops split between the commit and a follow-up revprop update.
  (replay_rev_started, replay_rev_finished, do_synchronize): Use that
    decision; skip the follow-up pass entirely when the commit carries
    author/date.

* subversion/tests/libsvn_repos/repos-test.c
  (commit_add_file, commit_editor_preserve_revprops): New test for both
    SVN_FS_TXN_CLIENT_DATE polarities via the commit editor.

* subversion/tests/cmdline/svnsync_tests.py
  (sync_to_local_preserves_author_date): New test: an ra_local sync
    preserves author/date with no post-commit revprop copy.

r1936010 | jpeck | 2026-07-08 20:16:06 +0000 (Wed, 08 Jul 2026)

90% Fix issue #3445: don't rewrite versioned payload in the write-through proxy.

The slave's body-rewrite filters blindly substituted the slave location
path with the master's across entire request and response bodies,
corrupting versioned data: file content in PUT bodies and property values
in PROPPATCH bodies.  Only protocol XML (MERGE/CHECKOUT/REPORT bodies,
multistatus responses) carries hrefs the proxy must translate.

On the request side, stop attaching the rewrite input filter to PUT and
PROPPATCH requests at all.  On the response side, gate the body filter
on the response Content-Type: anything that isn't protocol XML is
versioned payload and passes through untouched.

A residual remains: a dead-property *value* containing the master
location inside a genuine multistatus is still rewritten along with the
hrefs, fixing that requires further work.  See the new FIXME comment.
Regression tests will be in a follow-up commit.

* subversion/mod_dav_svn/mirror.c
  (proxy_request_fixup): Don't add the IncomingRewrite input filter for
   PUT and PROPPATCH requests; their bodies are versioned payload.
  (dav_svn__location_in_filter): Drop the obsolete FIXME, the hazardous
   methods no longer reach this filter.
  (response_is_xml): New helper.
  (dav_svn__location_body_filter): Remove ourselves from the filter
   chain for non-XML responses.  Document the residual dead-property
   rewrite.

r1936011 | jpeck | 2026-07-08 20:23:32 +0000 (Wed, 08 Jul 2026)

Fix URI-encoded vs non-encoded comparison of stored root dir

dav_svn__get_root_dir() returns the <Location> path canonicalized and
URI-encoded (create_dir_config() runs it through
svn_urlpath__canonicalize(), which normalizes by decode-then-encode),
but mirror.c treated it as decoded throughout.  For any location path
containing a URI-escapable character this made the write-through proxy
silently non-functional:

  - request routing searched the decoded r->uri for the encoded root,
    never matching, so write requests were never proxied and failed on
    the read-only slave;

  - both body-rewrite filters URI-encoded the already-encoded root and
    master paths a second time before compiling the search pattern
    ('%' is itself escaped, so "/svn%20repo" became "/svn%2520repo"),
    a byte sequence that can never occur in real protocol bodies

  - the COPY/MOVE Destination rewrite double-encoded the root the same
    way, so the ancestor comparison against the (encoded, normalized)
    Destination path always failed.

All latent for plain-ASCII locations, where the extra encode is a
no-op. Regression coverage coming in a follow-up commit.

* subversion/mod_dav_svn/mirror.c
  (proxy_request_fixup_destination): Use the stored root dir directly
   and correct the comment that misdescribed it as decoded.
  (dav_svn__proxy_request_fixup): Decode the root once and match the
   decoded form against the decoded r->uri.
  (dav_svn__location_in_filter, dav_svn__location_body_filter): Drop
   the double-encode of the pattern and replacement strings; both are
   already in the wire domain.

r1936012 | jpeck | 2026-07-08 20:32:27 +0000 (Wed, 08 Jul 2026)

Canonicalize SVNMasterURI at config-parse time, avoid re-encoding it

The SVNMasterURI directive value was stored verbatim, so a trailing slash
leaked "//" into every proxied filename and rewritten Destination header.
mirror.c URI-encoded the raw value before use, double-escaping any 
'%' in a master path that itself needs encoding.

Store the value canonicalized (no trailing slash, normalized escapes)
and establish the invariant that consumers use it as-is: the Destination
rewrite and the Location response-header match take it verbatim, and the
proxy filename now encodes only the (decoded) URI segment appended to
it.

This is a user-visible config improvement: SVNMasterURI values with a
trailing slash now work.  The mirror test harness deliberately
configures one to keep this canonicalized.

* subversion/mod_dav_svn/mod_dav_svn.c
  (SVNMasterURI_cmd): Canonicalize the value before storing it.
* subversion/mod_dav_svn/mirror.c
  (proxy_request_fixup): Build r->filename from the raw master URI plus
   the encoded segment.
  (proxy_request_fixup_destination): Don't re-encode the master URI in
   the rewritten Destination header.
  (dav_svn__location_header_filter): Match the stored master URI
   against the Location header without re-encoding it.

r1936013 | jpeck | 2026-07-08 20:42:08 +0000 (Wed, 08 Jul 2026)

Fix HTTP requests against <Location> paths with escapable characters.

This isn't really part of the mod_dav_svn proxy fixes, but this fix is
required to test the fix in 1936011. HTTPv2 commits failed with a 400
Bad Request against any mod_dav_svn repository whose <Location> path
contains a URI-escapable character.

get_resource() expects its ROOT_PATH argument in the decoded domain: it
strips it from the decoded r->uri (ap_stripprefix) and re-encodes it
for href output itself.  mod_dav's own method dispatch passes its
per-dir config, which is decoded, which is why plain DAV methods
(GET, PROPFIND, OPTIONS) always worked.  But three mod_dav_svn-internal
callers passed dav_svn__get_root_dir(), which is stored canonical and
URI-encoded.  Under "/svn repo", stripping "/svn%20repo" from
"/svn repo/!svn/me" fails, the URI parses as an ordinary repository
path, and dav_svn__method_post() bogusly rejects the transaction-
creation POST.  The same mismatch garbled the %f log path in
translate_name and made the SVNListParentPath root comparison never
match.

The domain contract, now honored by all in-tree callers: anything
comparing the stored root dir against r->uri must decode it first,
anything building client-visible URIs from it uses it as-is.

Regression-tested, updated tests coming in follow up commit 

* subversion/mod_dav_svn/repos.c
  (dav_svn__method_post): Decode the stored root dir before handing it
   to get_resource().
* subversion/mod_dav_svn/mod_dav_svn.c
  (dav_svn__translate_name): Likewise for dav_svn_split_uri().
* subversion/mod_dav_svn/util.c
  (dav_svn__is_parentpath_list): Decode before comparing against r->uri.

r1936015 | jpeck | 2026-07-08 22:39:36 +0000 (Wed, 08 Jul 2026)

Follow-up to r1936010: attach the rewrite filter by whitelist, not blacklist.
Continued fix for issue #3445

HTTPv2 clients send the log message and revision properties inside the
create-txn-with-props POST body, a length-prefixed skel carrying only
user data.  The rewrite corrupted revprop values that mention the slave
URL, and broke the skel framing outright (failing the commit) whenever
the master and slave location paths differ in length.

Invert the condition: only MERGE and CHECKOUT (v1) request bodies carry
protocol hrefs the master must resolve, so attach the filter only to 
those. A method missing from the whitelist now fails loudly at the master
(untranslated href) instead of silently corrupting user data.

Regression tests follow in the dav-mirror-autocheck.sh commit.

* subversion/mod_dav_svn/mirror.c
  (proxy_request_fixup): Attach the IncomingRewrite input filter only
   for MERGE and CHECKOUT requests, replacing the exclusion list.

r1936031 | jpeck | 2026-07-09 20:40:47 +0000 (Thu, 09 Jul 2026)

Follow-up to r1936015: whitelist the response-body rewrite filter too.
Continued fix for issue #3445

Only MERGE responses and PROPFIND responses carry protocol hrefs the 
proxy must translate back to the slave, so attach the ReposRewrite 
output filter only for those methods.  GET file content, LOCK's owner
echo and error bodies now pass through untouched. This closes the case
of an XML-mime-typed file's content being rewritten on a proxied read,
which the Content-Type gate could not fully exclude.
Proxied error text now keeps master paths.

* subversion/mod_dav_svn/mirror.c
  (proxy_request_fixup): Attach the ReposRewrite output filter only for
   MERGE and PROPFIND requests.

r1936032 | jpeck | 2026-07-09 22:24:20 +0000 (Thu, 09 Jul 2026)

Add the dav-mirror-autocheck.sh regression tests promised in r1936010-r1936031.

The mirror harness now runs everything against URI-encoded master and
slave locations ("master loc"/"slave loc", deliberately of different
lengths) and a slash-terminated SVNMasterURI, exercising the encoding
fixes.
New coverage:
- Log messages and revision properties containing the slave URL
  round-trip verbatim (create-txn-with-props POST bodies).
- The full lock lifecycle (a URL-bearing lock comment stored on the
  master, locked commit, release-on-commit, and explicit UNLOCK)
- Raw HTTP reads of open-transaction resources through the slave
  (file content verbatim, PROPFIND hrefs translated, XML-mime-typed
  content guarded).
- The one remaining SVN-3445 residual: dead-property values rewritten
  in a proxied multistatus, reported as XFAIL

The last 2 tests require curl for the transaction probes, no svn client
can hold a transaction open or address !svn/txr URIs

* subversion/tests/cmdline/dav-mirror-autocheck.sh: As above and fix a
  stray ">" in the generated master vhost's ServerName.
* subversion/mod_dav_svn/mirror.c
  (proxy_request_fixup_destination, response_is_xml): Correct some stale
  comments