Public bug reported:

Binary package hint: evolution-data-server

Steps to reproduce:

1. Set up a WebDAV contacts store with a username with an @ in it (e.g.
u...@domain.com). I'm using Zimbra.
2. In Evolution, create a new address book of type WebDAV and click OK:
Example URL: https://hostdomain.com/dav/someonesn...@clientdomain.com/Contacts
Example Username: myn...@clientdomain.com

Expected result:
- contact super-awesomeness
- Evolution looks up hostdomain.com, asks for a password, authenticates with 
usern...@clientdomain.com and the password, and requests the resource at
dav/someonesn...@clientdomain.com/Contacts

Actual result:
- Evolution pops up a dialogue with:
  Unable to perform search.
  This query did not complete successfully.
- evolution-data-server spits out:
  (process:18068): libebookbackendgoogle-WARNING **: PROPFIND on webdav failed
with http status 2
- Wireshark reveals that e-d-s tried to perform DNS lookups for
clientdom...@hostdomain.com. Unsurprisingly, it failed.

It looks like maybe e-d-s is wedging the username into the front of the URL in
the format https://usern...@domain.com without escaping the @, resulting in
this case in myn...@clientdomain.com@hostdomain.com, and then mis-parsing the
username as myname and the domain as clientdom...@hostdomain.com. If not, I
can't imagine what sort of crack is going on here.

Worth noting that the same credentials work fine for the other DAV stores
(calendaring, tasks).

** Affects: evolution-data-server
     Importance: Unknown
         Status: Unknown

** Affects: evolution-data-server (Ubuntu)
     Importance: Undecided
         Status: New

-- 
Mishandling of @ (at sign) in WebDAV contacts username (wrong DNS query)
https://bugs.launchpad.net/bugs/497146
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to evolution-data-server in ubuntu.

-- 
desktop-bugs mailing list
desktop-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs

Reply via email to