[ZCM] [ZC] 1851/ 2 Comment "WebDAV: bad URL quoting in "PropFind""

Issue #1851 Update (Comment) "WebDAV: bad URL quoting in "PropFind""
 Status Pending, Zope/bug medium
To followup, visit:
  http://www.zope.org/Collectors/Zope/1851

==============================================================
= Comment - Entry #2 by vincentkraeutler on Feb 2, 2007 9:04 am

failing to see a fix in this report (though perhaps it's just me), this works for me:

in lib/python/webdav/davcmds.py, line 164:

replace:
uri=os.path.join(url, absattr(ob.id))
with
uri=os.path.join(url, quote(absattr(ob.id)))

this is a one-word fix for a rather serious piece of breakage -- please consider applying it.

also, a session transcript which may help to illustrate the issue:

[snip]

HTTP/1.1 207 Multi-Status^M
Server: Zope/(Zope 2.7.5-final, python 2.3.5, linux2) ZServer/1.1^M

[...]

<d:response>
<d:href>/data/untitled%20folder/</d:href>
<d:propstat>
  <d:prop>

[...]

<n:resourcetype xmlns:n="DAV:"><n:collection/></n:resourcetype>
  </d:prop>
  <d:status>HTTP/1.1 200 OK</d:status>

[...]

</d:response>
<d:response>
<d:href>/data/untitled%20folder/untitled folder/</d:href>
<d:propstat>
                                  ***********

[snip]
________________________________________
= Request - Entry #1 by d.maurer on Jul 27, 2005 2:00 pm

"webdav.davcmds.PropFind.apply" uses "safe_quote" to quote
URLs.
"safe_quote" quotes iff the URL does not yet contain '%'.

This fails to quote the URL correctly in cases like this:

   PROPFIND /a%20b/

   when the collection "a b" contains an element whose
   id needs quoting, e.g. "my id".

   The recursive call to "apply" gets "/a%20b/my id" as "url"
   parameter in this case and "safe_quote" does not change it.


The fix quotes the id when the "url" is constructed for
the recursive "apply" call.

==============================================================