search

JDjimenezdelgado / wtclient

Automatically exported from code.google.com/p/wtclient
0 stars 0 forks source link

WebDAV Upload doesn't specify filename and if the user has access it overwrites the entire folder with a file in its place! #10

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago 
I am the developer of CrushFTP, a multi protocol server.  It includes WebDAV 
support.

I am noticing a bug in the client.  I have never used the client, but I see 
people connecting using the client and causing issues.

Example, I have a 2GB folder with lots of data in it.  Its in a folder called 
"demo".  I have given the user full access to this folder, so they can rename, 
delete, upload, etc.

Users using this client accidentally erase the entire folder when they are 
uploading a file.

I see in the headers that the client does:

PUT /demo/ HTTP/1.1

and then send the file's contents.  This erases the folder and writes a file in 
its place.

So they are technically uploading a file with no name.  I could reject what 
they are doing, although I think that would just break your client.  I may 
patch my server to do that though as I think the current resulting behavior is 
odd and not what was desired.

I would expect a header like:

PUT /demo/test.txt HTTP/1.1

Can you take a look at this issue?  I'm curious as to why you are hitting this. 
 CrushFTP is a widely deployed WebDAV server on thousands of servers around the 
world.  This bug has the potential to negatively affect a lot of people.

WebDAV testing server:  https://www.crushftp.com/demo/

User and pass is "demo".

I emailed you directly on this before I saw your issue tracker.

--Ben

Original issue reported on code.google.com by crush...@gmail.com on 31 Jan 2013 at 3:56