Dav: restored the request URI on a destination mapping error.

The COPY and MOVE handler temporarily replaces r->uri with the
destination to map it to a path, restoring it only on success.  When
ngx_http_map_uri_to_path() failed for the destination, the handler
returned without restoring r->uri, leaving it set to the client-supplied
destination.  Later processing that derives a target from the request
URI, such as an error_page with a variable, then resolved against the
destination instead of the request target.

diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c
index 1e66c2336c986a0eaca585667db505112bd51bbf..d58959a1271a4c8b908c742b9fbf632846e21383 100644 (file)
--- a/src/http/modules/ngx_http_dav_module.c
+++ b/src/http/modules/ngx_http_dav_module.c
@@ -721,6 +721,7 @@ overwrite_done:
     r->uri = duri;
 
     if (ngx_http_map_uri_to_path(r, &copy.path, &root, 0) == NULL) {
+        r->uri = uri;
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
     }