From ffe8222257d4d9da793c8085b3cca39599d2e812 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Tue, 22 Dec 2009 18:08:19 +0000
Subject: [PATCH] Redmine.pm: deny access if user doesn't have
 browse_repository permission (#4338).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3215 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 extra/svn/Redmine.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extra/svn/Redmine.pm b/extra/svn/Redmine.pm
index 20f795779..66dc6c03f 100644
--- a/extra/svn/Redmine.pm
+++ b/extra/svn/Redmine.pm
@@ -284,7 +284,7 @@ sub is_member {
 
       unless ($auth_source_id) {
 	  my $method = $r->method;
-          if ($hashed_password eq $pass_digest && (defined $read_only_methods{$method} || $permissions =~ /:commit_access/) ) {
+          if ($hashed_password eq $pass_digest && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
               $ret = 1;
               last;
           }