Password protected directories on http server can only be accessed by specifying the password in the URL

Bug #44647 reported by Nicholas Allen
256
Affects Status Importance Assigned to Milestone
Bazaar
Fix Released
Medium
Vincent Ladeuil

Bug Description

I have a bzr repository that I have pushed to my http sever via the sftp protocol. The directory that I pushed the repository to is protected from being read by the general public through an htpasswd file. When I try to branch from the http server I expected that I would be asked for a password and user name but instead I just got the message:

bzr: ERROR: http error 401 probing for XXXX/.bzr/branch-format

If I specify the user name and password as part of the URL then the branch command works but this is insecure and I would rather not do it this way.

Related branches

Revision history for this message
John A Meinel (jameinel) wrote :

This should be true when using pycurl, as we haven't figured out how to request passwords properly there.
Using 'bzr get http+urllib://' should properly prompt for a password. Can you verify whether this works or not?

Alternatively, you may need to specify the username without the password to get a prompt.

Changed in bzr:
status: Unconfirmed → Confirmed
Revision history for this message
Vincent Ladeuil (vila) wrote :

when using urllib you get prompted for each connection, see https://launchpad.net/products/bzr/+bug/42383.

Vincent Ladeuil (vila)
Changed in bzr:
assignee: nobody → v-ladeuil
Revision history for this message
Vincent Ladeuil (vila) wrote :

Commited in ~bzr/bzr/bzr.urllib.keepalive

Changed in bzr:
status: Confirmed → In Progress
John A Meinel (jameinel)
Changed in bzr:
status: In Progress → Fix Committed
Vincent Ladeuil (vila)
Changed in bzr:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.