svn-support: generate http downgrade only if we force_https in config.

docs/admin/svn-http.rst

@@ -27,6 +27,7 @@ Once installed you need to enable ``dav_svn``:
 
     $ sudo a2enmod dav_svn
     $ sudo a2enmod headers
+    $ sudo a2enmod authn_anon
 
 
 Configuring Apache Setup
@@ -55,7 +56,7 @@ permission issues could occur. To do this edit the ``/etc/apache2/envvars``
       export APACHE_RUN_GROUP=rhodecode
 
 1. To configure Apache, create and edit a virtual hosts file, for example
-   :file:`/etc/apache2/sites-available/default.conf`. Below is an example
+   :file:`/etc/apache2/sites-enabled/default.conf`. Below is an example
    how to use one with auto-generated config ```mod_dav_svn.conf```
    from configured |RCE| instance.
 

rhodecode/svn_support/templates/mod-dav-svn.conf.mako

@@ -16,7 +16,7 @@
 # `Include` directive. See the following example snippet of a virtual host how
 # to include this configuration file.
 #
-#     <VirtualHost *:8080>
+#     <VirtualHost *:8090>
 #         ServerAdmin webmaster@localhost
 #         DocumentRoot /var/www/html
 #         ErrorLog ${'${APACHE_LOG_DIR}'}/error.log
@@ -38,7 +38,11 @@
 
 # fix https -> http downgrade with DAV. It requires an header downgrade for
 # https -> http reverse proxy to work properly
+% if use_https:
 RequestHeader edit Destination ^https: http: early
+% else:
+#RequestHeader edit Destination ^https: http: early
+% endif
 
 <Location "${location_root|n}">
     # The mod_dav_svn module takes the username from the apache request object.

rhodecode/svn_support/tests/test_mod_dav_svn_config.py

@@ -68,7 +68,8 @@ class TestModDavSvnConfig(object):
             list_parent_path=True,
             location_root=self.location_root,
             repo_groups=repo_groups,
-            realm=self.realm
+            realm=self.realm,
+            use_ssl=True
         )
         # Assert that one location directive exists for each repository group.
         for group in repo_groups:
@@ -79,13 +80,15 @@ class TestModDavSvnConfig(object):
         self.assert_root_location_directive(generated_config)
 
     @pytest.mark.parametrize('list_parent_path', [True, False])
-    def test_list_parent_path(self, list_parent_path):
+    @pytest.mark.parametrize('use_ssl', [True, False])
+    def test_list_parent_path(self, list_parent_path, use_ssl):
         generated_config = utils._render_mod_dav_svn_config(
             parent_path_root=self.parent_path_root,
             list_parent_path=list_parent_path,
             location_root=self.location_root,
             repo_groups=self.get_repo_group_mocks(count=10),
-            realm=self.realm
+            realm=self.realm,
+            use_ssl=use_ssl
         )
 
         # Assert that correct configuration directive is present.
@@ -95,3 +98,10 @@ class TestModDavSvnConfig(object):
         else:
             assert re.search('SVNListParentPath\s+Off', generated_config)
             assert not re.search('SVNListParentPath\s+On', generated_config)
+
+        if use_ssl:
+            assert 'RequestHeader edit Destination ^https: http: early' \
+                   in generated_config
+        else:
+            assert '#RequestHeader edit Destination ^https: http: early' \
+                   in generated_config

rhodecode/svn_support/utils.py

@@ -25,6 +25,7 @@ from pyramid.renderers import render
 
 from rhodecode.events import trigger
 from rhodecode.lib.utils import get_rhodecode_realm, get_rhodecode_base_path
+from rhodecode.lib.utils2 import str2bool
 from rhodecode.model.db import RepoGroup
 
 from . import config_keys
@@ -42,7 +43,10 @@ def generate_mod_dav_svn_config(registry):
     repositories organized in sub folders.
     """
     settings = registry.settings
+    use_ssl = str2bool(registry.settings['force_https'])
+
     config = _render_mod_dav_svn_config(
+        use_ssl=use_ssl,
         parent_path_root=get_rhodecode_base_path(),
         list_parent_path=settings[config_keys.list_parent_path],
         location_root=settings[config_keys.location_root],
@@ -55,7 +59,8 @@ def generate_mod_dav_svn_config(registry):
 
 
 def _render_mod_dav_svn_config(
-        parent_path_root, list_parent_path, location_root, repo_groups, realm):
+        parent_path_root, list_parent_path, location_root, repo_groups, realm,
+        use_ssl):
     """
     Render mod_dav_svn configuration to string.
     """
@@ -72,6 +77,7 @@ def _render_mod_dav_svn_config(
         'repo_group_paths': repo_group_paths,
         'svn_list_parent_path': list_parent_path,
         'rhodecode_realm': realm,
+        'use_https': use_ssl
     }
 
     # Render the configuration template to string.

rhodecode/templates/base/vcs_settings.html

@@ -162,13 +162,13 @@
                     </div>
                     <div class="input">
                         ${h.text('vcs_svn_proxy_http_server_url',size=59)}
+                        % if c.svn_proxy_generate_config:
+                            <span class="buttons">
+                                <button class="btn btn-primary" id="vcs_svn_generate_cfg">${_('Generate Apache Config')}</button>
+                            </span>
+                        % endif
                     </div>
                 </div>
-                % if c.svn_proxy_generate_config:
-                    <div class="buttons">
-                        <button class="btn btn-primary" id="vcs_svn_generate_cfg">${_('Generate Apache Config')}</button>
-                    </div>
-                % endif
             </div>
         </div>
     % endif