doc/CHANGES.txt

@@ -18,6 +18,9 @@ Zope Changes
 
     Bugs Fixed
 
+      - Usage of 'urljoin' in 'webdav.davcmds' could lead to wrongly
+        constructed urls.
+
       - Fix #2141: TALES doesn't traverse correctly over 'repeat'
         variable
 

lib/python/webdav/common.py

@@ -42,6 +42,11 @@ def absattr(attr):
         return attr()
     return attr
 
+def urljoin(url, s):
+    url = url.rstrip('/')
+    s = s.lstrip('/')
+    return '/'.join((url, s))
+
 def urlfix(url, s):
     n=len(s)
     if url[-n:]==s: url=url[:-n]

lib/python/webdav/davcmds.py

@@ -23,10 +23,9 @@ import transaction
 from AccessControl import getSecurityManager
 from Acquisition import aq_parent
 from OFS.PropertySheets import DAVProperties
-from ZConfig.url import urljoin
 from zExceptions import BadRequest, Forbidden
 
-from common import absattr, aq_base, urlfix, urlbase
+from common import absattr, aq_base, urlfix, urlbase, urljoin
 from common import isDavCollection
 from common import PreconditionFailed
 from interfaces import IWriteLock
@@ -170,8 +169,8 @@ class PropFind:
                     if dflag:
                         ob._p_deactivate()
                 elif hasattr(ob, '__dav_resource__'):
-                    uri=urljoin(url, absattr(ob.id))
-                    depth=depth=='infinity' and depth or 0
+                    uri = urljoin(url, absattr(ob.getId()))
+                    depth = depth=='infinity' and depth or 0
                     self.apply(ob, uri, depth, result, top=0)
                     if dflag:
                         ob._p_deactivate()
@@ -409,7 +408,7 @@ class Lock:
         if depth == 'infinity' and iscol:
             for ob in obj.objectValues():
                 if hasattr(obj, '__dav_resource__'):
-                    uri = urljoin(url, absattr(ob.id))
+                    uri = urljoin(url, absattr(ob.getId()))
                     self.apply(ob, creator, depth, token, result,
                                uri, top=0)
         if not top:
@@ -474,7 +473,7 @@ class Unlock:
                 if hasattr(ob, '__dav_resource__') and \
                         (IWriteLock.providedBy(ob) or
                          WriteLockInterface.isImplementedBy(ob)):
-                    uri = urljoin(url, absattr(ob.id))
+                    uri = urljoin(url, absattr(ob.getId()))
                     self.apply(ob, token, uri, result, top=0)
         if not top:
             return result
@@ -529,7 +528,7 @@ class DeleteCollection:
             for ob in obj.objectValues():
                 dflag = hasattr(ob,'_p_changed') and (ob._p_changed == None)
                 if hasattr(ob, '__dav_resource__'):
-                    uri = urljoin(url, absattr(ob.id))
+                    uri = urljoin(url, absattr(ob.getId()))
                     self.apply(ob, token, user, uri, result, top=0)
                     if dflag:
                         ob._p_deactivate()