Public bug reported:

Binary package hint: evolution-data-server

Steps to reproduce:

1. Set up a WebDAV contacts store with a username with an @ in it (e.g.
[email protected]). I'm using Zimbra.
2. In Evolution, create a new address book of type WebDAV and click OK:
Example URL: https://hostdomain.com/dav/[email protected]/Contacts
Example Username: [email protected]

Expected result:
- contact super-awesomeness
- Evolution looks up hostdomain.com, asks for a password, authenticates with 
[email protected] and the password, and requests the resource at
dav/[email protected]/Contacts

Actual result:
- Evolution pops up a dialogue with:
  Unable to perform search.
  This query did not complete successfully.
- evolution-data-server spits out:
  (process:18068): libebookbackendgoogle-WARNING **: PROPFIND on webdav failed
with http status 2
- Wireshark reveals that e-d-s tried to perform DNS lookups for
[email protected]. Unsurprisingly, it failed.

It looks like maybe e-d-s is wedging the username into the front of the URL in
the format https://[email protected] without escaping the @, resulting in
this case in [email protected]@hostdomain.com, and then mis-parsing the
username as myname and the domain as [email protected]. If not, I
can't imagine what sort of crack is going on here.

Worth noting that the same credentials work fine for the other DAV stores
(calendaring, tasks).

** Affects: evolution-data-server
     Importance: Unknown
         Status: Unknown

** Affects: evolution-data-server (Ubuntu)
     Importance: Undecided
         Status: New

-- 
Mishandling of @ (at sign) in WebDAV contacts username (wrong DNS query)
https://bugs.launchpad.net/bugs/497146
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to evolution-data-server in ubuntu.

-- 
desktop-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs

Reply via email to