Using IIS 7, open IIS Manager, select the server node, double click the Handler Mappings feature. Click the action Add Managed Handler and configure the handler as follows:
- Request path: *.svn/* (wildcard mapping for all files in all .svn folders)
- Type: System.Web.HttpForbiddenHandler
- Name: Subversion-metadata (you can choose a different name if you like)
Now any request for files in the Subversion metadata folders named .svn in alle sites should return this:
Server Error in '/' Application.
This type of page is not served.
Description: The type of page you have
requested is not served because it has
been explicitly forbidden. Please
review the URL below and make sure
that it is spelled correctly.
You can choose a different handler type if you want, maybe a FileNotFound handler which will return a 404 status code.
For IIS 6 (with ASP.NET 2 installed and configured):
Navigate to Home directory > Configuration > Mapping and map the
.svn-base extension to
%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll. Then in machine.config (which you can find in
%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\CONFIG) you can add the same handler as above for the extension, add the following XML-element as a child of the
<add verb="*" path="*.svn-base" type="System.Web.HttpForbiddenHandler"/>
This will only prevent visitors from requesting the source code files, they could still request other files from the .svn folders. Map more extensions to aspnet_isapi.dll or make a wildcard mapping (will impact performance) and you could block more files from being requested.