Tue 07 Jul 2009 07:28:08 PM UTC, comment #3:
Hello Eric,
using the account data you supplied it did some short tests with your server. I found two serious bugs, but there is also a work around for this.
Bug 1:
The server claims to support WebDAV locks but does not. In response to a LOCK request it returns Error Code 200 OK but the response does not include the required Lock Token.
This is what I get with an OPTIONS request:
OPTIONS / HTTP/1.1
Host: xxxx
User-Agent: davfs2/1.4.1 neon/0.28.2
Keep-Alive:
Connection: TE, Keep-Alive
TE: trailers
Authorization: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
HTTP/1.1 200 OK^M
Date: Tue, 07 Jul 2009 18:21:24 GMT
Server: cPanel
Content-Length: 0
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
Allow: UNLOCK,HEAD,MOVE,OPTIONS,LOCK,POST,PUT,COPY,TRACE,MKCOL,GET,DELETE,PROPFIND
Content-Type: httpd/unix-directory
DAV: 1,2,<http://apache.org/dav/propset/fs/1>
Keep-Alive: timeout=15, max=96
MS-Author-Via: DAV
Header "DAV: 1,2" claims compliance class 2 which includes support for locks. This is also announced in the Allow Header.
But a LOCK request looks like this:
LOCK /test.txt HTTP/1.1
Host: xxxx
User-Agent: davfs2/1.4.1 neon/0.28.2
Connection: TE
TE: trailers
Content-Length: 184
Content-Type: application/xml
Depth: 0
Timeout: Second-1800
Authorization: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
<?xml version="1.0" encoding="utf-8"?>
<lockinfo xmlns='DAV:'>
<lockscope><exclusive/></lockscope>
<locktype><write/></locktype>
<owner>xxxxxxxxx</owner>
</lockinfo>
HTTP/1.1 200 OK
Date: Tue, 07 Jul 2009 18:21:39 GMT
Server: cPanel
Content-Length: 0
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
The response code is 200 OK but the response misses a lock-token header and a body with additional lock information. This is badly broken.
Bug2:
When I do a PUT request for the already existing file test.txt, I get this:
PUT /test.txt HTTP/1.1
Host: xxxx
User-Agent: davfs2/1.4.1 neon/0.28.2
Connection: TE
TE: trailers
Content-Length: 48
Authorization: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
This is a test file.
This is appended by Werner
HTTP/1.1 201 CREATED
Date: Tue, 07 Jul 2009 18:25:32 GMT
Server: cPanel
Content-Length: 16
Connection: Keep-Alive
Keep-Alive: timeout=15, max=100
Resource Created
The response code is 201 CREATED. This is only correct when a new resource is created. When an existing resource is replaced by a new version is must be 200 OK.
Serious shortcomming:
The server does not support Etag. I am not clear whether this is required by HTTP 1.1. But for WebDAV it is important to avoid unintended overwriting of someone elses changes to a resource.
Work around:
You can configure davfs2 to not use locks. You have to add option "use_locks 0" to your davfs2.conf file. I did a short test and it worked. File test.txt on the server should now be changed by me.
Though there is a work around, please report this bugs to the maintainer of the server. There is an increasing number of new WebDAV backends for Apache and other HTTP servers, most of which are seriously broken (or not seriously developed and tested). Writing a WebDAV module seems to have replaced the function of the famous "Hello World" program from when I was young.
Cheers
Werner
|