ColumPaget / Alaya

A webdav enabled webserver mostly focused on file storage
GNU General Public License v3.0
20 stars 4 forks source link

Invalid XML file in response to PROPFIND command #3

Closed skundu07 closed 3 years ago

skundu07 commented 3 years ago

Hello,

It seems the server is returning malformed XML file in response to PROPFIND command for a path that does not exist. A sample request and response are given below using cURL. In the returned XML file "<response>" has no corresponding end tag. For an empty tag, it should have been returned as "<response />".

<< PROPFIND /invalid_path/ HTTP/1.1
Host: nas.home.com:8082
Authorization: Basic dGVzdDp0ZXN0
Accept: text/xml
Depth: 0
Content-Type: text/xml
Content-Length: 182

>> HTTP/1.1 207 OK
>> Date: Tue, 23 Feb 2021 09:26:00 UTC
>> Cache-Control: no-cache
>> Pragma: no-cache
>> Connection: close
>> DAV: 1
>> Content-Type: text/xml
>> Content-Length: 220
>> 

<?xml version="1.0" encoding="UTF-8"?>
<multistatus xmlns="DAV:">
<href>http://nas.home.com:82/invalid_path/</href>
<propstat>
<prop>
</prop>
<status>HTTP/1.1 404 Not Found</status>
</propstat>
<response>
</multistatus>

Thanks for looking into this problem.

Regards, S. Kundu

ColumPaget commented 3 years ago

Good catch!

Thanks for this bug report. I'll get onto this as soon as I have a spare minute.

ColumPaget commented 3 years ago

This probably doesn't matter, as I guess you were just using this for testing, but you do realize that the password you've used here is decodable, right? I'm just worried you might be using that password for something else.

ColumPaget commented 3 years ago

Changes pushed to master. Should produce better xml now!