Use the absolute URL as the cache_key for repos-relative URLs in mod_authz_svn.
Use the absolute URL as the cache_key for repos-relative URLs in
mod_authz_svn.

This fixes what might have been a security problem since two different
repos might have the different authz files at the same path.  If we
use the repos-relative path as a cache_key then the second request
will use the first requests authz file for path based authorization.
Thus potentially allowing an attacker to bypass the authz rules by
making a request against a public repo, followed by a request against
a private repo without closing the connection.  The sort of configuration
that would allow such a thing to happen is precisely what in-repo authz
was intended to allow.

* subversion/mod_authz_svn/mod_authz_svn.c
  (get_access_conf): Move the resolution and canonicalization of a
    repos-relative URL before the determination of the cache_key.



git-svn-id: f8a4e5e023278da1e04e203c7fe051e3c4285d88@1463392 13f79535-47bb-0310-9956-ffa450edef68

YueLinHo/Subversion,YueLinHo/Subversion,YueLinHo/Subversion,YueLinHo/Subversion,YueLinHo/Subversion,YueLinHo/Subversion,YueLinHo/Subversion,YueLinHo/Subversion