From 2b84cd7dd79097e86c06ae1eae1d743c58af164c Mon Sep 17 00:00:00 2001 From: Vadim Zhestikov Date: Thu, 17 Sep 2026 10:23:21 -0700 Subject: [PATCH] Dav: restored the request URI on a destination mapping error. The COPY and MOVE handler temporarily replaces r->uri with the destination to map it to a path, restoring it only on success. When ngx_http_map_uri_to_path() failed for the destination, the handler returned without restoring r->uri, leaving it set to the client-supplied destination. Later processing that derives a target from the request URI, such as an error_page with a variable, then resolved against the destination instead of the request target. --- src/http/modules/ngx_http_dav_module.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/http/modules/ngx_http_dav_module.c b/src/http/modules/ngx_http_dav_module.c index 1e66c2336..d58959a12 100644 --- a/src/http/modules/ngx_http_dav_module.c +++ b/src/http/modules/ngx_http_dav_module.c @@ -721,6 +721,7 @@ overwrite_done: r->uri = duri; if (ngx_http_map_uri_to_path(r, ©.path, &root, 0) == NULL) { + r->uri = uri; return NGX_HTTP_INTERNAL_SERVER_ERROR; } -- 2.47.3