Index: lib/viewvc.py
===================================================================
--- lib/viewvc.py	(revision 1665)
+++ lib/viewvc.py	(working copy)
@@ -3087,12 +3087,15 @@
   if not cvs:
     generate_tarball_header(out, tar_dir, mtime=dir_mtime)
 
-  # Run through the files in this directory, skipping busted ones.
+  # Run through the files in this directory, skipping busted and
+  # unauthorized ones.
   for file in entries:
     if file.kind != vclib.FILE:
       continue
     if cvs and (file.rev is None or file.dead):
       continue
+    if not request.auth.check_path_access(_path_parts(file.name)):
+      continue
 
     # If we get here, we've seen at least one valid file in the
     # current directory.  For CVS, we need to make sure there are
@@ -3119,17 +3122,16 @@
     out.write(contents)
     out.write('\0' * (511 - ((len(contents) + 511) % 512)))
 
-  # Recurse into subdirectories, skipping busted ones.
+  # Recurse into subdirectories, skipping busted and unauthorized (or
+  # configured-to-be-hidden) ones.
   for file in entries:
     if file.errors or file.kind != vclib.DIR:
       continue
-
-    # Skip forbidden/hidden directories (top-level only).
     if not rep_path:
-      if (not request.auth.check_path_access(_path_parts(file.name))
-          or (cvs and request.cfg.options.hide_cvsroot
-              and file.name == 'CVSROOT')):
+      if cvs and request.cfg.options.hide_cvsroot and file.name == 'CVSROOT'):
         continue
+    if not request.auth.check_path_access(_path_parts(file.name)):
+      continue
 
     mtime = request.roottype == 'svn' and file.date or None
     generate_tarball(out, request, reldir + [file.name], stack, mtime)