[cvsnt] ACLs not working properly

[md at falcondev.com]

I'm currently testing CVSNT and I'm having problems with the access control lists. I have a module named source and I want to give access to it only to 2 users: Mark and Tom. John and the others should not see it.

I used the chacl command and gained the following results, reported by lsacl:
Directory: source
Owner: Mark

user=Mark
all

user=Tom
all

user=John
none

<default>
none

(...) and the same repeated for File:.cvsignore and File:build.xml

Unfortunately this setup doesn't prevent the remote user John from logging in to the cvsnt server by the :pserver method and checking out the contents of the source directory which I want to hide from him. I don't understand why. Please help.

Michael