Comment 8 for bug 322299

Ah, ok. <http://bazaar.launchpad.net/%7Earolsen/bazitis/trunk/annotate/head%3A/bazitis/templates/bazplugin.py> looks pretty suspicious to me. I haven't checked carefully, but I wouldn't be surprised if its path mangling was buggy.

(I'd recommend implementing that sort of access control by writing a plugin that overrides the 'bzr serve' command to use a custom transport, rather than by overriding LocalTransport globally inside bzrlib.)