Browser fails to access files or directories with spaces

[Jordi Mallach]

I've noticed our 0.12.1 install is unable to browse to directories with spaces in their filename, or show the content of files with spaces in their filename.

We have a good list of plugins installed, but I don't think any of them tamper with browser functionality.

I've created a new repo and a new trac env, and can reproduce this with ease. Except of my DEBUG log:

Trac[migrate_test:main] DEBUG: Dispatching <Request "GET '/browser'">
Trac[migrate_test:session] DEBUG: Retrieving session for ID 'jordi'
Trac[migrate_test:main] DEBUG: Negotiated locale: en-GB -> en_GB
Trac[migrate_test:api] INFO: Synchronized '' repository in 0.01 seconds
Trac[migrate_test:chrome] DEBUG: Prepare chrome data for request
Trac[migrate_test:perm] DEBUG: No policy allowed jordi performing BLOG_VIEW on None
Trac[migrate_test:main] DEBUG: Dispatching <Request "GET '/browser/default'">
Trac[migrate_test:session] DEBUG: Retrieving session for ID 'jordi'
Trac[migrate_test:main] DEBUG: Negotiated locale: en-GB -> en_GB
Trac[migrate_test:api] INFO: Synchronized '' repository in 0.01 seconds
Trac[migrate_test:chrome] DEBUG: Prepare chrome data for request
Trac[migrate_test:perm] DEBUG: No policy allowed jordi performing BLOG_VIEW on None
Trac[migrate_test:main] DEBUG: Dispatching <Request "GET '/browser/default/test%20with%20spaces'">
Trac[migrate_test:session] DEBUG: Retrieving session for ID 'jordi'
Trac[migrate_test:main] DEBUG: Negotiated locale: en-GB -> en_GB
Trac[migrate_test:api] INFO: Synchronized '' repository in 0.01 seconds
Trac[migrate_test:chrome] DEBUG: Prepare chrome data for request
Trac[migrate_test:perm] DEBUG: No policy allowed jordi performing BLOG_VIEW on None
Trac[migrate_test:main] WARNING: HTTPNotFound: 404 Trac error (<p class="message">No node test%20with%20spaces at revision 3</p><p>You can <a href="/trac/migrate_test/log/test%2520with%2520spaces?rev=3&amp;mode=path_history">search</a> in the repository history to see if that path existed but was later removed</p>)
Trac[migrate_test:main] DEBUG: Dispatching <Request "GET '/browser/default/hola'">
Trac[migrate_test:session] DEBUG: Retrieving session for ID 'jordi'
Trac[migrate_test:main] DEBUG: Negotiated locale: en-GB -> en_GB
Trac[migrate_test:api] INFO: Synchronized '' repository in 0.01 seconds
Trac[migrate_test:chrome] DEBUG: Prepare chrome data for request
Trac[migrate_test:perm] DEBUG: No policy allowed jordi performing BLOG_VIEW on None
Trac[migrate_test:main] DEBUG: Dispatching <Request "GET '/browser/default/hola/file%20with%20spaces'">
Trac[migrate_test:session] DEBUG: Retrieving session for ID 'jordi'
Trac[migrate_test:main] DEBUG: Negotiated locale: en-GB -> en_GB
Trac[migrate_test:api] INFO: Synchronized '' repository in 0.01 seconds
Trac[migrate_test:chrome] DEBUG: Prepare chrome data for request
Trac[migrate_test:perm] DEBUG: No policy allowed jordi performing BLOG_VIEW on None
Trac[migrate_test:main] WARNING: HTTPNotFound: 404 Trac error (<p class="message">No node hola/file%20with%20spaces at revision 3</p><p>You can <a href="/trac/migrate_test/log/hola/file%2520with%2520spaces?rev=3&amp;mode=path_history">search</a> in the repository history to see if that path existed but was later removed</p>)

The repo can be accessed perfectly via the SVN client. Subversion is at 1.6.12 (Debian squeeze).

Attached is a dump of the repo, but nothing too interesting there: just a dir and a file with spaces.

[Jordi Mallach]

Dump of a minimal SVN repo that triggers this

[Christian Boos]

This is most probably related to your web front-end, tell us more about your setup.

Are you proxying from fastcgi to tracd via flup by any chance? If so, you should try the -q parameter (see TracStandalone#Usingtracdbehindaproxy).

[Jordi Mallach]

The following patch "fixes" this for me:

svn_fs.py

@@ -46 +46 @@
 import os.path
 import weakref
 import posixpath
+import urllib
 
 from trac.config import ListOption
 from trac.core import *
@@ -81 +82 @@
     x = core.svn_path_canonicalize('/'.join(args).lstrip('/')
                                                     .encode('utf-8'),
                                       pool)
+    return urllib.unquote(x)
 
 def _from_svn(path):
     """Expect an UTF-8 encoded string and transform it to an `unicode` object

The problem is that svn expects to get the request as an unquoted URL. Adding this call, the request is done correctly — but you get the space quoting in the printed url (in the body and title of the page). (the url that your browser shows will be ok though):

 source: default/test%20with%20spaces @ 2 

Now, besides the aesthetics of this solution (which needs fix), I have no clue of the security implications that unquoting the url might bring. I leave that to the Trac experts. :)

[Jordi Mallach]

Replying to cboos:

This is most probably related to your web front-end, tell us more about your setup.

Are you proxying from fastcgi to tracd via flup by any chance? If so, you should try the -q parameter (see TracStandalone#Usingtracdbehindaproxy).

As usual, you hit the nail right on the head. Our setup is based on a nginx frontend for all the chrome stuff, so yep, we were missing this argument.

Thanks a lot Christian!

[Christian Boos]

You're welcome!

Yep, the problem sounded familiar and I was sure that we normally support white spaces in browser paths ;-)

Please don't hesitate to improve the nginx related documentation (TracFastCgi, TracNginxRecipe), this is a grey area for me as I've never used that particular configuration.

[Jordi Mallach]

I see we can do some contributions to the authentication section. I'll see if I can devote some work time for that, I'm sure my boss wouldn't have a problem.