If-Match / If-None-Match PUT broken-ness in mod_dav

[Tim Olsen <ti...@brooklynpenguin.com>]

Hello,

I am concerned about two particular bugs in mod_dav that have been
known for a while.  They are bugs 16593 and 38034 and are related to
the use of the If-Match and If-None-Match headers when doing PUT
requests (and other requests as well such as LOCK).  See

http://issues.apache.org/bugzilla/show_bug.cgi?id=16593
http://issues.apache.org/bugzilla/show_bug.cgi?id=38034

I consider these bugs serious because If-Match and If-None-Match are
the essential headers to use - particularly if the client does not
implement locks - to prevent the lost-update problem. Apache's mod_dav
is the flagship open-source WebDAV server implementation, but because of
these bugs, many clients (such as davfs) do not make use of the
If-Match and If-None-Match headers, which IMO should be used on pretty
much every PUT request.

The first bug, 16593, was opened in 2003.  I'm still not up to speed on
apache module hacking, but I may be able get one of my team members to
submit a patch.

The second bug, 38034, was
opened in 2005 and has a patch attached as of last month.  Is there any
way we can get this into trunk, or better yet, the stable branch?

Thanks!

Tim Olsen

Re: If-Match / If-None-Match PUT broken-ness in mod_dav

[Tim Bray <Ti...@Sun.COM>]

On Aug 28, 2007, at 9:08 AM, Tim Olsen wrote:

> http://issues.apache.org/bugzilla/show_bug.cgi?id=16593
> http://issues.apache.org/bugzilla/show_bug.cgi?id=38034

I find the mod_dav code a little scary, but on the other hand I have  
ETags working properly with PUT in mod_atom, and there are a couple  
of little gotchas that can getcha.  So if someone is looking at this,  
maybe I can help.   If nobody's looking at it, I suppose I could hold  
my breath and wade into the mod_dav swamp, but I'd really rather not,  
I'd be really worried about breaking something; do we have people  
here who grok mod_dav & could answer questions?

> I consider these bugs serious because If-Match and If-None-Match are
> the essential headers to use - particularly if the client does not
> implement locks - to prevent the lost-update problem.

+1 -T