[PATCH PR55304] mod_dav: COPY should not validate the parent of request.

[Ben Reser <be...@reser.org>]

This patch fixes a regression created by the PR54610.  COPY does not
modify the parent of the source, so it should not be validating the
parent.  This issue actually disallows the ability to COPY the root of
a DAV repository since a properly implemented DAV provider will return
NULL and dav_method_copymove() will error on that.

We ran into this with Subversion, which actually revealed a security
issue with our implementation of get_parent_resource() since it failed
on the root.  But beyond that we realized we were not properly
returning NULL for some resources when the resource is the root and
thus has no parent.  If we fix this without this patch being made to
mod_dav then HTTP 2.2.25 and 2.4.6 will lose the ability to COPY the
root.

If someone can apply it that would be appreciated.  It's certainly
been looked at by several eyes over on the Subversion side.

Re: [PATCH PR55304] mod_dav: COPY should not validate the parent of request.

[Greg Stein <gs...@gmail.com>]

Fixed in r1506714, and proposed for backport to 2.2.x and 2.4.x.

On Wed, Jul 24, 2013 at 3:38 PM, Ben Reser <be...@reser.org> wrote:
> This patch fixes a regression created by the PR54610.  COPY does not
> modify the parent of the source, so it should not be validating the
> parent.  This issue actually disallows the ability to COPY the root of
> a DAV repository since a properly implemented DAV provider will return
> NULL and dav_method_copymove() will error on that.
>
> We ran into this with Subversion, which actually revealed a security
> issue with our implementation of get_parent_resource() since it failed
> on the root.  But beyond that we realized we were not properly
> returning NULL for some resources when the resource is the root and
> thus has no parent.  If we fix this without this patch being made to
> mod_dav then HTTP 2.2.25 and 2.4.6 will lose the ability to COPY the
> root.
>
> If someone can apply it that would be appreciated.  It's certainly
> been looked at by several eyes over on the Subversion side.