apache2.4 with webdav give an 405 error

Question

I just upgraded my test machine from Apache 2.2.29 to 2.4.10 and actually Im getting some issue with webdav module.

If I try to login to a webdav account it works but if I try to list my current directory I got a 405 error.

I know some config as change with this new version, I did some change to get my virtualhost compatible with 2.4.

I got 2 virtualhost actualy all of these are come from my 2.2 setup, I updated them a bit to be ready with 2.4. One of them works fine with webdav but the second one generate a 405 on listing directory.

Here is my virtualhost who is working:

Apache log :

10.19.87.87 - maxence [02/Jan/2015:16:30:12 +0100] "PROPFIND / HTTP/1.1" 207 6331 "-" "Cyberduck/4.6.1 (16121) (Windows 7/6.1) (x86)"

---

    <VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot /home/web/working/dev/

    ServerName webdav.working.test.net
    ServerAlias webdav.working.test.net

    ErrorLog /var/log/apache2/net.test.working.webdav-error.log
    CustomLog /var/log/apache2/net.test.working.webdav-access.log combined

    <Files ".ht*">
        allow from all
    </Files>

    <Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    <Location />
        DAV on
        AuthName "test WebDAV Storage - working"
        AuthType Basic
        AuthUserFile /etc/apache2/htpasswd-webdav
        <Limit GET POST PUT DELETE PROPFIND PROPPATCH MKCOL COPY DUPLICATE MOVE LOCK UNLOCK OPTIONS HEAD>
        Require valid-user
        </Limit>
        AddType text/html .php .phtml
    </Location>

</Virtualhost>

And now, the one who is not working :

Apache Log :

10.19.87.87 - maxence [02/Jan/2015:16:10:54 +0100] "PROPFIND / HTTP/1.1" 405 475 "-" "Cyberduck/4.6.1 (16121) (Windows 7/6.1) (x86)"

---

<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot /home/web/notworking/dev/

    ServerName webdav.notworking.test.net
    ServerAlias webdav.notworking.test.net

    ErrorLog /var/log/apache2/net.test.notworking.webdav-error.log
    CustomLog /var/log/apache2/net.test.notworking.webdav-access.log combined

    <Files ".ht*">
        allow from all
    </Files>

    <Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    <Location />
        DAV on
        AuthName "test WebDAV Storage - notworking"
        AuthType Basic
        AuthUserFile /etc/apache2/htpasswd-webdav
        <Limit GET POST PUT DELETE PROPFIND PROPPATCH MKCOL COPY DUPLICATE MOVE LOCK UNLOCK OPTIONS HEAD>
        Require valid-user
        </Limit>
        AddType text/html .php .phtml
    </Location>

</Virtualhost>

As you can see my DAV config are exactly the same. Folders rigth got same configuration :

 drwxr-xr-x 7 www-data www-data      26 déc.  24 12:07 dev

If someone got any clue to know why I can't list my directory, it'll help me a lot :)

Solution 1

There seems to be a bunch of people who have come accross this issue after the last update.

I found my answer here: on the Dav on directories, disable the Directory index features with the following directive:

DirectoryIndex disabled

Of note: one of the websites I manage was defaced on January 7th through an "Hmei7" php attack on old copies of wordpress I had placed in an accessible place and forgotten about. Don't leave old php-based apps lurking around at visible places!

Solution 2

As ThBB already pointed out, the DirectoryIndex is the problem, because the index script will receive the HTTP request and won't handle it.

In my case I need the index-feature, because I have a web app in the target directory. I have a deployment script which deletes the directory, creates it again and then uploads all files. To keep my deployment script working together with DirectoryIndex I simply had to place an additionaly DELETE request for the index file before the DELETE request for the containing directory:

DELETE /my-app/index.html
DELETE /my-app
MKCOL /my-app
POST /my-app/index.html
POST /my-app/foo.bar
... all other files ...