webdav-server/webdav.conf at main · vaggeliskls/webdav-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
DavLockDB "${DAV_LOCK_DB}"

# Disable TRACE method server-wide (information disclosure risk)
TraceEnable Off

# ---------------------------------------------------------------------------
# Information disclosure — minimise what the server reveals about itself.
# ---------------------------------------------------------------------------
ServerTokens Prod
ServerSignature Off

# ---------------------------------------------------------------------------
# Request hardening (DoS / resource-exhaustion mitigations).
# ---------------------------------------------------------------------------
# Slowloris / slow-POST: drop clients that dribble the request too slowly.
RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500

# Cap the size of WebDAV XML control bodies (PROPFIND / PROPPATCH / LOCK).
# This does NOT limit file uploads — only the XML messages — so it is safe to
# keep tight. Guards against oversized/XML-bomb control requests.
LimitXMLRequestBody ${LIMIT_XML_REQUEST_BODY}

# Cap upload (PUT) body size. 0 = unlimited (default, preserves prior
# behaviour). Set LIMIT_REQUEST_BODY to a byte count to prevent disk-fill DoS.
LimitRequestBody ${LIMIT_REQUEST_BODY}

# Refuse recursive "Depth: infinity" PROPFIND — a cheap request that forces a
# full-tree walk (amplification vector). Affects PROPFIND only; COPY/MOVE/
# DELETE of collections are unaffected. Set DAV_DEPTH_INFINITY=On to allow.
DavDepthInfinity ${DAV_DEPTH_INFINITY}

Alias / "/var/lib/dav/data/"

# Root directory — deny all by default.
# Per-folder blocks generated at startup (webdav-folders.conf) override this.
<Directory "/var/lib/dav/data/">
  Dav On
  Options +Indexes
  DirectoryIndex disabled
  # Prevent trailing-slash redirects (301 on PROPFIND /folder confuses Windows
  # Mini-Redirector — it never follows up with PROPFIND /folder/ so folders
  # appear empty). WebDAV clients handle both /folder and /folder/ correctly.
  DirectorySlash ${DIRECTORY_SLASH}
  IndexIgnore .DAV .* desktop.ini Thumbs.db

  # Use UTF-8 every time
  IndexOptions Charset=UTF-8

  ### Table configuration
  IndexOptions FancyIndexing
  IndexOptions HTMLTable
  IndexOptions SuppressDescription
  IndexOptions SuppressRules
  IndexOptions NameWidth=*

  ### Sorting options
  IndexOrderDefault Ascending Name
  IndexOptions IgnoreCase
  IndexOptions FoldersFirst
  IndexOptions VersionSort

  Require all denied
</Directory>

# Per-folder access config — generated by docker-entrypoint.sh at container startup
Include conf/webdav-folders.conf

# These disable redirects on non-GET requests for directories that
# don't include the trailing slash (for misbehaving clients).
BrowserMatch "Microsoft-WebDAV-MiniRedir" redirect-carefully
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "MS FrontPage" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[01234]" redirect-carefully
BrowserMatch "^gnome-vfs/1.0" redirect-carefully
BrowserMatch "^XML Spy" redirect-carefully
BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
BrowserMatch " Konqueror/4" redirect-carefully
BrowserMatch "^gvfs" redirect-carefully