Skip to content

Commit

Permalink
Fix WebDAV traversal
Browse files Browse the repository at this point in the history
Fix a traversal error that happens when traversing a WebDAV resource and the virtual host monster is used.

Fixes #195
  • Loading branch information
ale-rt committed Feb 22, 2024
1 parent 9d79be1 commit d2ca56e
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 1 deletion.
2 changes: 2 additions & 0 deletions news/195.bugfix
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
Fix a traversal error that happens when traversing a WebDAV resource and the virtual host monster is used.
[ale-rt]
11 changes: 10 additions & 1 deletion plone/dexterity/browser/traversal.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
from plone.dexterity.filerepresentation import FolderDataResource
from plone.dexterity.interfaces import DAV_FOLDER_DATA_ID
from plone.dexterity.interfaces import IDexterityContent
from Products.SiteAccess.VirtualHostMonster import VirtualHostMonster
from webdav.NullResource import NullResource
from zope.component import adapter
from zope.publisher.interfaces.browser import IBrowserRequest
Expand Down Expand Up @@ -38,7 +39,15 @@ def publishTraverse(self, request, name):

defaultTraversal = super().publishTraverse(request, name)

# If this is a WebDAV PUT/PROPFIND/PROPPATCH request, don't acquire
if isinstance(defaultTraversal, VirtualHostMonster):
# If we are traversing to a VHM, we want to just return it immediately.
# For WebDAV requests, the check that controls if the parent
# of the traversed object is the same as the context
# will most probably fail because VHM parent will usually be
# the Zope App object.
return defaultTraversal

# If this is a WebDAV PUT/PROPFIN1D/PROPPATCH request, don't acquire
# things. If we did, we couldn't create a new object with PUT, for
# example, because the acquired object would shadow the NullResource

Expand Down

0 comments on commit d2ca56e

Please sign in to comment.