From: Yann Ylavic <ylavic@apache.org>
Date: Wed, 24 Jun 2020 12:23:15 +0000 (+0000)
Subject: Follow up to r1879074: don't let dav_process_if_header() go above root.
X-Git-Tag: 2.5.0-alpha2-ci-test-only~1335
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=574db2f781576f8f526532c2935cab5bda210038;p=thirdparty%2Fapache%2Fhttpd.git

Follow up to r1879074: don't let dav_process_if_header() go above root.

And fall through as "/".


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1879149 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/modules/dav/main/util.c b/modules/dav/main/util.c
index 8cf3fe5234e..08ebe2764e6 100644
--- a/modules/dav/main/util.c
+++ b/modules/dav/main/util.c
@@ -665,6 +665,7 @@ static dav_error * dav_process_if_header(request_rec *r, dav_if_header **p_ih)
 
             /* clean up the URI a bit */
             if (!ap_normalize_path(parsed_uri.path,
+                                   AP_NORMALIZE_NOT_ABOVE_ROOT |
                                    AP_NORMALIZE_DECODE_UNRESERVED)) {
                 return dav_new_error(r->pool, HTTP_BAD_REQUEST,
                                      DAV_ERR_IF_TAGGED, rv,