From: Vadim Zhestikov <v.zhestikov@f5.com>
Date: Thu, 17 Sep 2026 17:23:21 +0000 (-0700)
Subject: Dav: restored the request URI on a destination mapping error.
X-Git-Tag: release-1.31.8~15
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=2b84cd7dd79097e86c06ae1eae1d743c58af164c;p=nginx.git

Dav: restored the request URI on a destination mapping error.

The COPY and MOVE handler temporarily replaces r->uri with the
destination to map it to a path, restoring it only on success.  When
ngx_http_map_uri_to_path() failed for the destination, the handler
returned without restoring r->uri, leaving it set to the client-supplied
destination.  Later processing that derives a target from the request
URI, such as an error_page with a variable, then resolved against the
destination instead of the request target.
---

diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c
index 1e66c2336..d58959a12 100644
--- a/src/http/modules/ngx_http_dav_module.c
+++ b/src/http/modules/ngx_http_dav_module.c
@@ -721,6 +721,7 @@ overwrite_done:
     r->uri = duri;
 
     if (ngx_http_map_uri_to_path(r, &copy.path, &root, 0) == NULL) {
+        r->uri = uri;
         return NGX_HTTP_INTERNAL_SERVER_ERROR;
     }