Currently, master is polluted with merge commits (--no-ff) which makes it really hard to read. I propose to rebase master to get a clean, readable history and avoid any merge from within GitHub which produces a merge commit.

I consider a merge commit justified if you have tens or hundreds commits on your branch and you need additional comments on, but not in our case for one or two commits per branch.

Here is an example, cleaned up master: https://github.com/michael-o/websvn/commits/rebased_master

Given that we have very little clones, this can be justified to be done for our users.

The site uses calls like the following to store two cookies:

setcookie('storedlang', $language, time() + (60 * 60 * 24 * 356 * 10), '/');
setcookie('storedsesslang', $language);

setcookie('storedtemplate', $template, time() + (60 * 60 * 24 * 365 * 10), '/');
setcookie('storedsesstemplate', $template);

I've checked the history why for each value two cookies are set and the only reason is to have that value available most likely in case users have their browser configured to prevent long time cookies:

// Override this with the user choice if there is one, and memorise the setting
// as a cookie (since we don't have user accounts, we can't store the setting
// anywhere else). We try to memorise a permanant cookie and a per session cookie
// in case the user's disabled permanant ones.

be9ced6#diff-f08e511b493e1780d6974ef34a09c477R275

I don't think we need to go that extra step and didn't see that elsewhere. If users don't want cookies, let them be, we don't need to care and maintain two values in my opinion.

Additionally, path handling is inconsistent and especially setting one to '/' makes that cookie be sent too ALL sites published by e.g. http://localhost/app_1|app_2|.... Path handling should be left to PHP, which uses the current request directory. If that doesn't work properly, the session-cookie doesn't make any sense at all and the attached screenshot show it does work.

So I suggest switching to a session-cookie only and remove explicit path handling in favour of PHP-defaults. Thoughts?

In my install of Subversion 1.10.4 the svnauthz command is installed to /scm/bin/svn-tools/svnauthz (I built from source with --prefix=/scm).

I was able to kludge my install by making a symlink in /scm/bin (where svn sits), but perhaps the path to that command should be separately configurable (or maybe both paths should be checked), since some may not be able to kludge their install as I could.

Hello !
Thank you for this useful app ;)
I have just a small remark very easy to correct : there is no "viewport" tag defined, so the mobile navigation is not optimal.
Maybe you can just add this line in the "head" section of your templates :

<meta name="viewport" content="width=device-width, initial-scale=1">

thanks ;)

404 Error is used in scenarios where $repo is not found. But there is no proper template to handle it. This is how it looks if 404 is invoked.

My proposal is to have a 404 page put in.

since version 2.4 it's not possible anymore to see folders with dedicate access but no access to root folder

example:

svn-tree:

branches/
tags/
trunk/
trunk/folder1
trunk/folder1/folder_a

apache.authz

[groups]
admin= admin
user= user

[/]
*=
@admin=rw

[/trunk]
@user=rw

[/trunk/folder1/]
user2=r

Issue

user 2 can't see /trunk/folder1/folder_a/ or even /trunk/folder1
even if you provide &path variable to url pointing to /trunk/folder1/ you won't be able to see content of this path in WebSVN

properly related to this

In issue #44 and pull request #46 the user greeting message was moved from index.tmpl to user_greeting.tmpl for the calm and Elegant templates. However the default message describing where the message can be customized wasn't changed and still refers to index.tmpl instead of user_greeting.tmpl.

As of now if I need to access repositories stored on the network drives i need to run the apache service hosting websvn with that accessible username.

What i am requesting is to optionally add network mounting in the websvn someway in configuration class or someplace to be used in config.php as an optional setting.

Right now i use something like the following in the config.php file that works for me.

exec('net use G: "\\\\server\\mountfolder" /user:"domain-userid" "domainpassword" /persistence:no');
$config->addRepository('Name to Display','file:///G://path//to//repos//');

Maybe this is a one off use case in my scenario where i need to host all repository from a single sever where repos are stored in multiple geographical areas in different drives. But still a good feature to have optionally.

The current code contains the following docs:

// You may also optionally specify the URL that clients should use to check out
// a working copy. If used, it must be specified after the group, username, and
// password; if these arguments are not needed, then pass null instead. Consult
// the WebSvnConfig class in include/configclass.php for function details.

In #112 it has been discussed if a working copy is used at all and it seems this is not the case (anymore). But why are the above docs available then? They seem misleading talking about a working copy if that is not used.

I've searched the code and it seems the above docs map to some arguments called clientRootURL in some classes and those are still used in the PHP files and templates. Mostly with tests like the following, though:

[websvn-test:clientrooturl]

This should be looked at, as I have the feeling that all of this can simply be removed from everywhere. Might be some leftover from the past using working copies.

Hello everyone, :
Sorry if it has been answered but
I'm facing an issue with apostrophe and ampersand since version 2.4 (no issue with 2.3.3).
Even on folder name or file name, I got error "E160013: File not found"
Additionnal log :
"Error running this command: svn --non-interactive --config-dir /tmp/websvn log --xml --limit 2 'file:///home/repositories//IS/FR_%26amp%3B_EN@', referer: https://dev.lcl/websvn/listing.php?repname=IS" For ampersand

Is there someone who faced the same isssue?
Any clue on what has change in early versions which may cause the issue?
Many thanks for your answers

websvn-2.3.3.tar.gz, Ubuntu 16.04.4 LTS, PHP 7.0.30-0ubuntu0.16.04.1

I'm getting:

PHP Parse error: syntax error, unexpected 'new' (T_NEW) in /var/www/html/websvn/lib/pear/Text/Diff.php on line 383

Hi guys,

If interested, I think that is good idea to create new project and port all features from WebSVN to new version with Symfony support.

Then will more easy to maintain the project.

What you think guys?

Let's use the milestones in the tickets to track version-related changes. This makes users way easier to scan through changes w/o having an incomplete file or worse reading git log for every single new version.

I have a suggestion here that i would like to discuss. I would like to propose a File Search Feature. #119
This searches only for files with some name in the directory and this is not a content search.

How we normally do this right now is using the following command(Windows Only):
(Note: I have repos on network drive hence the path looks UNC style. In normal case it will look like a normal windows path)

C:\Windows>svnlook tree --full-paths "\\path_to_repos\svn\repos\EOS" | find "LifeSign"
branches/general/BaseDevice/gaLibTestScripts/LifeSignSv_UDI.py
branches/general/BaseDevice/gaLibTestScripts/LifeSignSv_UI.py
tags/gaLibTestScripts_0.6.0.1_01_12_2019/LifeSignSv_UDI.py
tags/gaLibTestScripts_0.6.0.1_01_12_2019/LifeSignSv_UI.py
tags/gaLibTestScripts_1.0.0.0_05_06_2020/LifeSignSv_UDI.py
tags/gaLibTestScripts_1.0.0.0_05_06_2020/LifeSignSv_UI.py
tags/gaLibTestScripts_1.0.0.99_27_04_2020/LifeSignSv_UDI.py
tags/gaLibTestScripts_1.0.0.99_27_04_2020/LifeSignSv_UI.py
trunk/BaseDevice/gaLibTestScripts/LifeSignSv_UDI.py
trunk/BaseDevice/gaLibTestScripts/LifeSignSv_UI.py

For unix system it would look something like this (uses grep):

svnlook tree --full-pahts "\\path_to_repos\svn\repos" | grep "LifeSign"

The advantage of this is multi fold.
1 - It is that all available paths where the files are there are listed in a single view.
2 - Using the existing compare feature i can just select the two files i want to see and do a compare.
3 - This can be used to list the entire directory in tree view as we have an open issue #104

The disadvantage of this is also multi fold.
1 - It is available only where the WebSVN has a direct repository access and not a URL access. The reason for this is that the command that is used is svnlook tree that only works with direct access repos and not URL access.
2 - I am not sure about the performance penalty if any. I have small size repos only 4-10 GBs. So it is very very fast.
But i am not sure in scenarios of huge repositories.But as it is a native command so hopefully should be fine.

I have added the snapshot from the svn book.

Running websvn on PHP 7.3 produces the following warning:

Warning: count(): Parameter must be an array or an object that implements Countable in /usr/local/www/websvn/include/diff_util.php on line 58

This is due to a change to the count() function in PHP 7.2

I tried a simple change to strlen(), but that produced a list of these:
Notice: Undefined offset: 74 in /usr/local/www/websvn/include/diff_util.php on line 71

So some of the users have come back with the error when they compare between two tags or between revisions.

Pushing the PHP to 1GB memory has solved the issue for now.

But i am wondering is there something that can be done to optimize this.
Is there anyway this can be improved?

We are using WebSVN 2.5 with Apache 2.4.37 and have about 120 Repositories and authorization via active directory. WebSVN is very slow! It takes about 50 seconds to load the index page with all repositories (even on the server machine using localhost/websvn)! According to Chrome the TTFB is about 40 second. So what can be the reason for this long response time?
The standard svn web page is loaded in about 500 ms.

The expectation is to have a collapsible file comparison view. Here in the snapshot below is an attempted slight improvement in the existing compare view.

1 - Is the view of collapsed file. You click on the file bar and it collapse
2 - The expanded view click on view and it expands.
I just used the existing jquery functions to achieve this and here is the commit snapshot

It is really helpful in scenarios when comparing two folders in subversion with lot of files in them at different revisions.
I didnt see any use of jquery as it is purely in php so not sure this is an expected way of implementing this.
Any thoughts on this?

First off, thanks you for updating this great tool!

We have been using WebSVN for a number of years and stayed happily with 2.3.3 until last week.
The new version (2.4) works great in supporting downloads and comparison in a PHP 7+ environment, but one thing that has changed is the way that WebSVN connects to subversion.

In our apache/subversion setup we use
AuthzForceUsernameCase Lower

The old WebSVN (2.3.3) worked very well with this setting, but WebSVN 2.4 require users to login with their username in lowercase to match the configuration used in the subversion authz-file. While it is not really a big deal, it still probably affects a lot of installations.
I don't know php-programming, but comparing the old auth.php and the new authz.php indicates that the old 2.3.3 version used strtolower() on the user name, but the new version does not?

My suggestion would be to add a new configuration parameter to let the user decide if WebSVN should force lowercase/uppercase or not.

/J

Hi, thanks for the great work on this. Are there any future plans for adding markdown rendering? Your project is giving us everything we need except for that, and we just noticed that VIsualSVN implemented a "homepage" similar to the GitHub homepage (displaying readme markdown) when browsing to the project trunk.

I may end up taking a stab at this if there were no plans for it.

Also, this project is still being maintained? I saw a comment in one of the other issues threads when talking about WebSVN2 that the original project is dead. Was that referring to this project?

Thanks again!

My background.

In the past, my SVN repos where organized pretty flat, all in one directory and that has been published by svnserve. I recently refactored this to allow multiple subdirs to divide things by customers or some topic etc., which is easily supported by svnserve, because it maps all relative URLs to repos into its one and only configured root path. That is different for mod_dav_svn and WebSVN, the latter being more difficult, though.

Multiple config files necessary.

From my understanding, WebSVN only loads repos somehow known to config.php, either being directly configured or using a parent path, pretty much like svnserve supports. The difference is that WebSVN ignores all non-repos in the configured parent path, so one needs to configure multiple parent paths and that leads to another problem: Each parent path needs its own config.php and that is assumed under a hard-coded path by WebSVN to be included. So one not only needs to maintain multiple config.php currently, but as well one installation of WebSVN.

In this issue I would like to discuss alternatives, especially because additional subdirs might provide performance benefits, as fewer repos need to be checked for if the current user has access to those.

Configurable path to config file.

The first problem to solve is that WebSVN doesn't assume one config file in its own installation directory anymore by convention. That assumption forces one to need multiple installations of WebSVN in worst case.

The workaround I'm currently implementing for that problem is simply setting environment variables based on the requested location in Apache httpd. The requested location reflects the relative dir structure of my repos, corresponds to a lot of Location blocks in httpd and ultimately things are mapped to one environment variable containing a path to config.php.

While the many Location blocks are some maintenance overhead as well, one doesn't need to additionally maintain individual WebSVN-installations. Besides that, all those blocks allow individual handling of things like authentication, different realms and stuff. I for example implemented a custom auth-handler using mod_perl, reusing passwd-files for all individual repos and stuff.

The following is a PR implementing my approach and containing example configs for httpd:

#87

Layered configs.

The downside of the former approach is that for each parent path with SVN-repos an individual config.php is necessary, making configs for templates, paths to tools etc. redundant. In most cases it's pretty likely in my opinion that all repos should be presented the same way, so share a lot of configs.

Because configs are only PHP-code setting properties, it should be easy to layer them by simply processing one after another following some convention. E.g. my current implementation either uses the conventional environment variable or config.php the old way, but could as well easily use one after the other.

Discussion.

What's your opinions? Do you have a similar use case and if so, how do you deal with it?

Today on repo have a folder ./doc with install and other documentation, but is necessary move this to site.

Hello, just found this fork.
Seen there is some activity.
Will you do a release in the future?

Both templates provide the option to customize a specific text block. While the idea is nice, it poses a problem when WebSVN is managed by a ports/package manager. If an admin changes that text block, this is overriden as soon as an update happens by your OS.

In my case, I have changed calm/index.tmpl for a factory related stuff I work, but FreeBSD daily root reports nag me that the checksum of the file has been changed.

How can we solve this better? Is has to be a per-template config option because the structure is different.
E.g., $config->setTemplateAboutText($templateName, $textBlock)?

Hi
The "Compare with previous" shows wrong color of the differences
(using php 7.3.23)
See screenshot as an example

The websvn installation docs still require pear and a few packages. Citation from https://websvnphp.github.io/docs/install.html

apt-get install php-pear
pear channel-discover pear.geshi.org
pear install Archive_Tar
pear install geshi/geshi
pear install Text_Diff

I know pear is not deprecated, but perhaps these dependencies can be moved to composer, being more future proof?

The three packages should all be available on packagist:

• https://packagist.org/packages/geshi/geshi
• https://packagist.org/packages/pear/archive_tar
• https://packagist.org/packages/pear/text_diff

(for more info see https://stackoverflow.com/questions/34199824/what-is-the-difference-between-pear-and-composer)

Hello. It would great to disable binary files diffs e.t.c. My repo has big binaries and server is dying when someone tries to open changes between revisions. How could I manage this?

Dear Sirs and Madams!

I am trying to setup WebSVN for my Subversion repositories on my DS918+ NAS. I've installed WebSVN as VirtualHost, set the path to repository in .php file and when I try to access it, I get:
_Unable to find "svnauthz" tool at location "/bin/svnauthz"

_
Can someone please help me?

I'm getting these errors in my Apache error.log

PHP Notice: Undefined variable: path in /var/www/websvn/include/configclass.php on line 590

that line is in the function
function hasLogReadAccess($pathWithSub)

should line 590 be using $pathWithSub instead of $path ?

It would seem the old site of http://websvn.info has died a death and is now hosting god knows what. Should probably be replaced with https://websvnphp.github.io

One of the most commonly used feature atleast for me is the compare paths in the listing view.

The issue is, it is not possible in the listing view to compare same file across multiple tags or branches or even in different folders in a same tag.

For example consider below two directories under tags(as seen in image).
[1] and [2] as in image attached.
As [2] is open i can see files within it. But if i have to compare it with files in [1] I cannot use this UI for comparison as when i open the folder [1] the folder [2] closes.

Things are not better when i select a file in tag and try to compare it with one in trunk. As soon as i click on the trunk folder the tag folder closes.

Anyway of fixing this?

Take an example of structure as below:
Say we are at current revision 40
--- SomeFile @ 40
--- TargetFile @ 23
What this means that SomeFile is at revision 40.
TargetFile too is at revision 40 but has not changed since revision 23.

In scenario if i am doing a comparison using a compare path and put this TargetFile and put the revision as 38 - 40.
The diff should return bool(false) meaning it says that there has been no change in the TargetFile from revision 38-40
This is what is currently missing. It would be good to have this feature.

As it has been implemented currently:

We just check that $diff stream is returned. We dont check whether the $diff stream is returned as false.
A check for that should be added and we should print that "No changes found between commits" or something similar.

I get the following warning when i try to compare any two paths. I am using svn 1.10.3, Apache version 2.4.35 with a SVN client 1.9.5

Can anybody tell me how to resolve this?

Since projet is on github now (very strange this) we need to add readme for repository.

Have a look at the snapshot from Elegant Template:

Same from the Blue Grey Template shows the following message:

I am not able to figure out why the same comparison works in one template and doesnt in the another.

This code was made for PHP 5.2, but this version was discontinued since few years ago.

I think that is good to update source code to PHP 7 for support to install this project on new OS versions, like Ubuntu 16.04/17.04 LTS, CentOS 7.1 and others.

What you think @tschoening?

As discussed in #7, I like to have all of my changes merged piece by piece:

Removed bundle GeSHi, use setGeshiScriptPath() to point to a managed installation.

Tedious to maintain manually, externalize.

Fixed GeSHi 1.0.9.0 compat

Introduces scoping through public/protected

Removed bundled PEAR installation with Archive_Tar and Text_Diff, use PEAR directly

include_path modification has not been removed in master

Removed manual parsing of authz file and use svnauthz(1)

The manual parsing in PHP is broken. Therefore it has been replaced with svnauthz(1). This has been available for years. Time to switch.

Moved server location to /repos/websvn by default

Internal reasons especially because in cannot be changed in config.php and require file modification. FreeBSD ports nags with checksums errors for file which haven't been marked as config files.

Moved svnConfigDir to /tmp/websvn by default

This change can be dropped, but not recommended. Not fond of having config files in pure /tmp.

Renamed useAuthenticationFile to useAccessFile because it does authz only

The authz is for access/authorization only. Rename for clarification. Though, incomplete class Authentication has to be renamed.

Improved output of datetimeFormatDuration
Fixed directory listing not obeying showAgeInsteadOfDate
Replaced hyphen-minus with a stylistically proper en dash

Must be propagated througout all templates

Removed any WebSVN-side authentication handling

This should really be done by the server. WebSVN never did any authentication, it simply prompted with Basic.

Renamed wsvn.php to browse.php for a nicer URL

Friendly URLs to avoid duplicates like /websvn/wsvn.

Removed old-fashied templates BlueGray and Element, they aren't maintained anymore

Can be reintroduced.

Fixed CVE-2016-2511
Fixed CVE-2013-6892

Must be merged IMHO.

Introduced config->setLocale() so UTF-8 handling in svn handling

Requires some polish as mentioned by @tschoening with putenv() (setup.php) as long as it does not cause any side effects.

Removed checks for old PHP and Subversion versions

Removed use of quoteCommand()

I cannot remember the reason, but there was one. Need to investigate.

Please tell which changes don't need any further discussion. I'd create PRs for them first.

May websvn integrate an online web editor even without markdown support?
It will be very useful when we need to do little changes to config file or README.

WebSVN supports multiple different languages and allows the user to choose one. But it doesn't seem to automatically detect a language based on the browser preferences. This should be added if necessary.

Additionally, it should be discussed if to still store a chosen language in the cookie. That is the case currently, but when taking browser preferences into account and those change, the cookie values wouldn't be updated once set etc. So it might be considered to really only take browser preferences into account, even though some people consider this bad style. Some people use a browser language for most sites and a site-specific one for some others, like English in case no better language is available.

Looks like PHP provides some helpers already, one needs to have a look at those as well:

https://www.php.net/manual/en/locale.acceptfromhttp.php
https://www.php.net/manual/en/locale.lookup.php

Finally got around to trying to update WebSVN and noticed that commit ec00fa7 dropped apparently redundant code and noted that since PHP 5.3 commands are automatically quoted on Windows.
This, however, is not entirely true, as the removed code is checking the PHP version only for some calls. php/php-src@19322fc from 2008 only covers exec and related, not proc_open (which, for whatever reason, does it's own thing in /ext/standard/proc_open.c - one of three calls to CreateProcessW in the entire source tree).
Please consider adding the quoting back on Windows.
Thanks.

I know this is a weird case, imagine an authz file like this:

[/]
somebody = rw
[/branches/a]
tfisher = r

In v2.3.3 when I access websvn it will list this repository on the repository list and I can navigate in directly, though it shows me nothing other than /branches/a (that is, / only contains "branches" and /branches only contains "a")

But in v2.5 it omits the repository from the repository list and attempting to access /branches (by doctoring the URL) yields "You do not have the necessary permissions to view this content." But if I doctor the URL to access /branches/a, it works fine.

To be honest, the new behavior makes sense since it just reflects what svnauthz reports, but it is causing a lot of wailing amongst my user base. So I need to figure out how to revert to the old behavior. I will try to dig into the source code to fix this, but any assistance would be welcome.

PHP Deprecated: Methods with the same name as their class will not be constructors in a future version of PHP; ParentPath has a deprecated constructor in /var/www/websvn/include/configclass.php on line 102

lots more...

TortoiseSVN can be launched with an url.

https://tortoisesvn.net/docs/release/TortoiseSVN_en/tsvn-automation-urlhandler.html

Wouldn't it be a nice feature to have a link to TortoiseSVN in the diff page?

I'm struggling to differentiate between the old and new documentation.

This is a request to document:

• How to install websvn (from git; today this means 2.4)
• How to upgrade an old 2.3.3 installation to use this fork/version (likely, 2.3 -> 2.4)
• The current status of the websvn project; specifically related to this fork and the 2.3.3 version

For example, changes.txt might reference 2.4 somehow; maybe with a link on top to the 2.4 milestone page?

I came across that the context path ($locwebsvnhttp) fo the app has to be set manually in browse.php. Can't we leverage $_SERVER['CONTEXT_PREFIX'] as the default config? This works at least for me in the MultiViews case.

One still can change this value on his/her server.

WDYT?

it uses error_log which logs passwords from the commandline to syslog (and further if you have remote logging which i do)

from my personal notes:

//filter logmessage
function errorlog($string) {
        $string = preg_replace("/--password '.*'/", "--password '***'",$string);
        error_log($string);
}

# en dan met vi :g/error_log/s//errorlog/
# en dan de laatste error_log weer fixen

[View Log] click.
/log.php?repname=somerep&path=somepath&isdir=1&

And [Show changed files] click
/log.php?repname=somerep&path=somepath&isdir=1&showchanges=1

Then the link in the "Diff" column should look like this:
/comp.php?repname=somerep&compare[]=somepath@revnum1&compare[]=somepath@revnum2

However, I found that sometimes the path length were hundreds or thousands of characters long.
I checked and found that if the PATH tag in the xml obtained by running "svn log" splits into 2 lines, the link URL is broken. It's not clear why PATH is split when it contains non-ascii characters (xml_parse function specification?)
So I fixed it as follows and it works.
Is this patch correct?
If you have another solution, please let me know.

--- a/include/svnlook.php
+++ b/include/svnlook.php
@@ -450,12 +450,12 @@
 			$curMod = $curLog->curEntry->curMod;
 			if ($curMod->action == 'A') {
 				if ($debugxml) print 'Examining added path "'.$curMod->copyfrom.'" - Current path = "'.$curpath.'", leafname = "'.$leafname.'"'."\n";
-				if ($data == $curLog->path) {
+				if ($curLog->curEntry->curMod->path == $curLog->path) {
 					// For directories and renames
 					$curLog->path = $curMod->copyfrom;
-				} else if ($data == $curpath || $data == $curpath.'/') {
+				} else if ($curLog->curEntry->curMod->path == $curpath || $curLog->curEntry->curMod->path == $curpath.'/') {
 					// Logs of files that have moved due to branching
-					$curLog->path = $curMod->copyfrom.'/'.$leafname;
+					$curLog->path = $curMod->copyfrom;
 				} else {
 					$curLog->path = str_replace($curMod->path, $curMod->copyfrom, $curLog->path);
 				}

After changing these as follows, it seems to be working good.

comp.php
filedetails.php
log.php

--- a/comp.php
+++ b/comp.php
@@ -372,6 +372,7 @@
 
 				// Check for a new node entry
 				if (strncmp(trim($line), 'Index: ', 7) == 0) {
+					$line = mb_convert_encoding($line, 'UTF-8', 'auto');
 					// End the current node
 					if ($node) {
 						$listing[$index++]['endpath'] = true;
@@ -393,7 +394,7 @@
 					$listvar = &$listing[$index];
 					$listvar['newpath'] = escape($absnode);
 
-					$listvar['fileurl'] = $config->getURL($rep, $absnode, 'file').'rev='.$rev2;
+					$listvar['fileurl'] = $config->getURL($rep, toOutputEncoding($absnode), 'file').'rev='.$rev2;
 
 					if ($debug) echo 'Creating node '.$node.'<br />';
 
@@ -439,6 +440,7 @@
 
 						$node = $propnode;
 
+						$node = mb_convert_encoding($node, 'UTF-8', 'auto');
 						$listing[$index++]['newpath'] = $node;
 						clearVars();
 					}

--- a/filedetails.php
+++ b/filedetails.php
@@ -108,10 +108,10 @@
 
 	// If a MIME type is associated with the file, deliver with Content-Type header.
 	if ($history && !empty($mimeType) && $rep->hasReadAccess($path, false)) {
-		$base = basename($path);
+		$base = basename(urldecode($path));
 		header('Content-Type: '.$mimeType);
 		//header('Content-Length: '.$size);
-		header('Content-Disposition: inline; filename='.urlencode($base));
+		header('Content-Disposition: inline; filename="'.$base.'"; '."filename*=UTF-8''".rawurlencode($base));
 		$svnrep->getFileContents($path, '', $rev, $peg);
 		exit;
 	}

--- a/log.php
+++ b/log.php
@@ -307,7 +307,7 @@
 				$listvar['revlog'] = nl2br($bugtraq->replaceIDs(create_anchors(xml_entities($revision->msg))));
 				$listvar['rowparity'] = $row;
 
-				$listvar['compareurl'] = $config->getURL($rep, '', 'comp').'compare[]='.$rpath.'@'.($thisrev - 1).'&compare[]='.$rpath.'@'.$thisrev;
+				$listvar['compareurl'] = $config->getURL($rep, '', 'comp').'compare[]='.urlencode($rpath).'@'.($thisrev - 1).'&compare[]='.urlencode($rpath).'@'.$thisrev;
 
 				if ($showchanges) {
 					// Aggregate added/deleted/modified paths for display in table

I used this project years ago, but currently this project is still used.

On oficial WebSVN mailinglist, the creator of project open a thread to talk about a new maintainer. Today I use git for my projects, but I'm a PHP developer and I know how to SVN works, then I can help and continue project without problems.

What you think @dirk-thomas? I want to add you on @websvnphp organization too, because if you not created this project, a lot of customers would have a option to see your SVN repositories data.

Reference:
http://websvn.tigris.org/ds/viewMessage.do?dsForumId=1547&dsMessageId=3172668

While working on #8, I have noticed that Debian applied a series of patch too against 2.3.3. It would be good to apply them too.

Package site: https://packages.debian.org/de/jessie/websvn as well as the tarball with the patches.

Notable patches:
31_CVE-2016-1236.patch

This is an umbrella ticket.

Note: some patches won't be applied because they have been fixed in the meantime.