在 Windows 上从 PHP 更新 Subversion - 权限相关（访问被拒绝）
我编写了一个 PHP 脚本来更新 SVN 工作副本。
它在我的开发机器（W2k3 服务器）上运行良好，但我无法让它在生产服务器（W2k8 服务器）上运行。我正在使用最新的 Collabnet Subversion 二进制文件 (1.6.17)。
这是 PHP 代码：
$command = 'svn update C:\inetpub\wwwroot\mysite --config-dir C:\Windows\Temp';
$response = array();
$handle = popen("$command 2>&1", 'r');
$read = '';
while( $read = fread( $handle, 20096 ) )
{
$response[] = $read;
}
pclose( $handle );
flush();
echo '<h2>Command</h2><p> ' . $command . '</p>';
echo '<h2>Response</h2><p>' . implode( '<br />', $response ) . '</p>';
当我从命令提示符运行相同的命令时，它工作正常。但是当我通过 IIS 运行它时，我得到：
svn：无法打开文件“C:\inetpub\wwwroot\mysite.svn\lock”：访问被拒绝。
大概我需要提升权限，但我不知道如何实现它。
我尝试让 _IUSR 帐户完全控制包含 svn 的文件夹和 C:\inetpub\wwwroot\mysite.svn\ 文件夹，但这没有什么区别。
谢谢
I have written a PHP script which updates a SVN working copy.
It works fine on my development machine (W2k3 Server)but I cannot get it to work on a production server (W2k8 Server). I'm using the latest Collabnet Subversion binaries (1.6.17).
Here's the PHP code:
$command = 'svn update C:\inetpub\wwwroot\mysite --config-dir C:\Windows\Temp';
$response = array();
$handle = popen("$command 2>&1", 'r');
$read = '';
while( $read = fread( $handle, 20096 ) )
{
$response[] = $read;
}
pclose( $handle );
flush();
echo '<h2>Command</h2><p> ' . $command . '</p>';
echo '<h2>Response</h2><p>' . implode( '<br />', $response ) . '</p>';
When I run the same command from the command prompt it works fine. But when I run it through IIS, I get:
svn: Can't open file 'C:\inetpub\wwwroot\mysite.svn\lock': Access is denied.
Presumably I need elevated permissions but I have no idea how to implement it.
I've tried giving the _IUSR account full control of the folder containing svn and the C:\inetpub\wwwroot\mysite.svn\ folders but it makes no difference.
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
SVN 和 Windows Server 2008 也遇到过类似的问题。该问题是由 UAC 内容引起的，该内容通常会阻止某人更改不拥有该文件的文件。就 SVN 而言，问题通常是由一名用户执行初始签出，创建 .svn 文件夹和相关位。然后，另一个用户访问 svn up 并遇到了有关修改 SVN 数据库文件的操作系统级访问问题。
不幸的是，我们能找到的最佳解决办法是禁用 UAC。实际上解决了其他一些问题，并且它在服务器上确实有意义。如果它作为计划任务运行，那么您可以尝试“以最高权限运行”，但提升这么多对于网络应用程序来说没有什么意义。
Had issues just like this with SVN and Windows Server 2008. The issue is caused by the UAC stuff that typically prevents someone from changing a file if they don't own the file. In the case of SVN, the issue was typically that one user performed the initial checkout, creating the .svn folders and associated bits. Then a different user went to
svn upand got OS-level access issues about modifying the SVN database files.Unfortunately, the best fix we could get to was disabling UAC. Actually solved a few other problems and it really makes sense on servers. If it is running as a scheduled task then you could try "run with highest priviliges" but elevating that much makes little sense for a web app.
C:\inetpub\wwwroot\mysite.svn的读/写访问权限。C:\inetpub\wwwroot\mysite.svn授予对 IIS 属性中的文件夹的写入权限。C:\inetpub\wwwroot\mysite.svnif it is a checkout.C:\inetpub\wwwroot\mysite.svn.我认为您需要专门向运行 PHP 的用户授予读/写权限。在我的例子中，php 作为 Apache 模块运行，因此它在同一帐户下运行。我不太熟悉你的设置，但基本思想是相同的。一旦您确定了在哪个帐户下运行 PHP，请授予它对锁定文件的写入权限，您的问题就会消失。
我不建议在生产服务器上禁用 UAC！永远！！！ 您希望为最少数量的用户授予最少的权限以及最少的必要资源。
请勿删除所有用户帐户安全性来写入锁定文件！！！ 相反，请授予单个写入权限。不能完全控制。将其授予需要它的单个用户（可能是本地系统帐户）。将其授予需要写入的特定文件（C:\inetpub\wwwroot\mysite.svn\lock）。
这种方法可以防止您打开可能被恶意软件利用的安全漏洞！
I think you need to specifically grant read/write permissions to the user that PHP is running under. In my case php is running as an Apache module, so it runs under the same account. I am less familiar with your setup, however the basic idea is the same. Once you have determined what account you are running PHP under, grant it write permissions to the lock file and your problem should go away.
I DO NOT recommend disabling UAC on a production server!! EVER!!! You want to grant the smallest amount of permissions for the smallest number of users to the smallest amount of resources necessary.
DO NOT remove all of your user account security to write to a lock file!!! Instead, grant the single permission write. Not full control. Grant it to the single user who needs it (likely the local system account). Grant it for the specific file(C:\inetpub\wwwroot\mysite.svn\lock) which it needs to write to.
This approach keeps you from opening a security hole that could be exploited by the malicious!
谢谢大家。最后所有这些答案都有帮助。
我需要做几件事：
执行 svn 清理
如果设置权限时访问被拒绝，则关闭 UAC
所有.svn文件夹都需要用户组的读/写权限。
但是，没有明显的方法可以做到这一点，因此需要设置权限
在整个站点目录上。
之后 PHP 脚本就能够执行 svn update 命令。唷！
Thanks everyone. In the end all these answers helped.
I needed to do several things:
Performed a svn cleanup
Turned of UAC if access is denied when setting permissions
The top level .svn folder needed write permissions for IIS_IUSR
All .svn folders need Read/Write permissions for the Users group.
However, there's no apparent way to do this, so the permissions need to be set
on the whole site directory.
After which the PHP script was able to perform an svn update command. Phew!