Philippe Nobili wrote:
> 
> Since we upgraded to XMLMind 4.2.1 (previously used in production was
> version 3.8.1), some of our editors cannot access their documents
> through WebDAV anymore. When clicking on 'Browse Remote Files' in the
> URL selection box, the following error message is popped up:
> 
> Cannot connect to:
> "http:......" (address skipped)
> HTTPClient.AuthSchemeNotImplException: NTLM
> 
> But the same URL works fine and allow to browse our WebDAV repository
> with XMLMind 3.8.1 and on the Web browser (Firefox in this case).
> Thank for any idea you have that might explain (solve ?)  this pretty
> annoying problem.

--> If the error message is correct, there is no possible regression here.

"Browse Remote Files" has never, ever, supported the NTLM (Microsoft
specific, undocumented) authentication scheme.

However:

* Web browsers support the NTLM authentication scheme.

* Java's native HTTP client (but not our WebDAV client 3.8.1 or 4.2.1),
 supports the NTLM authentication scheme on Windows. As a consequence,
if you do not use "Browse Remote Files" and just type the URL then click
OK, XXE may be able to open your file (not 100% sure).



--> If your WebDAV server does not use the NTLM authentication scheme
(but rather the BASIC or DIGEST standard authentication schemes), then
you have found a bug. But in order to fix it, you'll have to let me
access your WebDAV server.



Reply via email to