Webdav file creation problem

saw 2011-08-30 10:44:36 UTC #1

Hi,

using gnome to mount webdav shares from EGW (1.8.002) and try to create files in a subdir, there is problem with the lock mechanism.
The problem is in phpgwapi/inc/class.vfs_webdav_server.inc.php (line 445) which calls egw::lock without the option false (check_writable parameter of function lock in ./phpgwapi/inc/class.egw_vfs.inc.php ) as last parameter. Default is true, which means, in front of the file creation process, the file is checked to be writable. But if a new file is created, the file doesn’t exist at this time and thsi prevents the lock which results in an error message and aborts the file creation process.

Please consider to add the patch, which fixes this problem.
webdav.patch (869 Bytes)

Thank you.

S. Wefel

Ralf_Becker_Stylite 2011-08-30 12:08:24 UTC #2

Hi,

using gnome to mount webdav shares from EGW (1.8.002) and try to create
files in a subdir, there is problem with the lock mechanism.
The problem is in phpgwapi/inc/class.vfs_webdav_server.inc.php (line 445)
which calls egw::lock without the option false (check_writable parameter of
function lock in ./phpgwapi/inc/class.egw_vfs.inc.php ) as last parameter.
Default is true, which means, in front of the file creation process, the
file is checked to be writable. But if a new file is created, the file
doesn’t exist at this time and thsi prevents the lock which results in an
error message and aborts the file creation process.

Please consider to add the patch, which fixes this problem.
http://egroupware.219119.n3.nabble.com/file/n3295144/webdav.patch
webdav.patch

Thank you.

S. Wefel

I think the patch is the wrong approach, write access is checked to not
allow anyone to lock resources without having the authorization for that.

I would suggest the following:

Index: phpgwapi/inc/class.egw_vfs.inc.php

— phpgwapi/inc/class.egw_vfs.inc.php (Revision 36365)
+++ phpgwapi/inc/class.egw_vfs.inc.php (Arbeitskopie)
@@ -1304,7 +1304,8 @@
static function
lock($path,&$token,&$timeout,&$owner,&$scope,&$type,$update=false,$check_writable=true)
{
// we require write rights to lock/unlock a resource

  if (!$path || $update && !$token || $check_writable &&

!egw_vfs::is_writable($path))

  if (!$path || $update && !$token || $check_writable &&

  	!(egw_vfs::is_writable($path) || !egw_vfs::file_exists($path) &&

egw_vfs::is_writable(egw_vfs::dirname($path))))
{
return false;
}

It checks for not existing files write access to the parent-directory
instead.

Let me know, if that fixes your problem.

Ralf

Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

Commerzbank BLZ 55040022 | Account 218111300
IBAN DE33 5504 0022 0218 1113 00 | BIC COBADEFFXXX
VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany

Special Offer – Download ArcSight Logger for FREE!
Finally, a world-class log management solution at an even better
price-free! And you’ll get a free “Love Thy Logs” t-shirt when you
download Logger. Secure your free ArcSight Logger TODAY!
http://p.sf.net/sfu/arcsisghtdev2dev

eGroupWare-developers mailing list
eGroupWare-developers@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-developers

saw 2011-08-30 16:58:20 UTC #3

I agree, this is a security issue. I had not considered this, because I thought the permission for file creation are checked otherwise and not with the lock function. But you are right, someone could obtain a simple lock command and lock files without permission.

Your lock patch for class.egw_vfs.inc.php fixes the problem too and it is more global nature because it works with other vfs.

Please apply this to the next EGW revision.

Thanks in advance,
S. Wefel

Ralf_Becker_Stylite 2011-08-30 17:05:10 UTC #4

Ok, fix is commited and backport to all branches including 1.8