mod_proxy/3658: FTP proxy may misdisplay directory with filenames containing embedded spaces.

[Cliff Hones <cl...@aonix.co.uk>]

>Number:         3658
>Category:       mod_proxy
>Synopsis:       FTP proxy may misdisplay directory with filenames containing embedded spaces.
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Wed Jan 13 09:00:03 PST 1999
>Last-Modified:
>Originator:     cliff@aonix.co.uk
>Organization:
apache
>Release:        1.3.3
>Environment:
Linux RedHat 5.2 kernel 2.0.36
>Description:
1)
If Apache is used as an FTP proxy to display a directory whse first entry
is a filename with an embedded space the directory listing is displayed
incorrectly, and the links to the files are corrupted.

A similar problem (PR279, now closed) has been reported.  The fix for
PR279, which is in the current Apache sources, only works correctly
when the first filename in the directory listing contains no spaces.
This is normally the case for a Unix FTP server (when the first entry
is . or ..), but is not necessarily the case for other servers (eg W95).

2)
The HREF= text in the link generated for a filename does not escape
embedded spaces (using %20).  This causes a problem for some browsers
(eg Netscape) which truncate the filename at the first space when the
link is followed.  IE4 appears ok.
>How-To-Repeat:
1)
Configure your browser to use an Apache server (on any machine) for proxy FTP.
Set up an FTP server on a W95 machine.  Create a directory on the FTP
server and create some files in the directory with spaces embedded in the
file names.  Ensure the directory is exported by the FTP server, and then
use your browser to display it using ftp://<site>/<dir>.

2)
Add a file without an embedded space in its name to the
directory on the FTP server.  Ensure that the new file comes
alphabetically before the others, so it is displayed fist in
a directory listing.  Visit the directory with a Netscape browser,
and try to follow one of the links to a file with an embedded space.
>Fix:
Routine send_dir in proxy_ftp.c needs enhancing to deal with directory
listings correctly.  It currently assumes that the first filename will not
contain an embedded space, and uses the position of the start of this
filename in the line to determine the starting position of the filenames
in subsequent entries.  It also fails to convert spaces to %20's when
forming the link HREF.

This would also be a good opportunity to extend the proxy server to cope
with eg VMS-style directory listings (see PR700).

>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, ]
[you need to include <ap...@Apache.Org> in the Cc line ]
[and leave the subject line UNCHANGED.  This is not done]
[automatically because of the potential for mail loops. ]
[If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request ]
[from a developer.                                      ]
[Reply only with text; DO NOT SEND ATTACHMENTS!         ]