Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following directive in my Apache httpd.conf:

   deny from all

OPTIONS and PROPFIND work as expected, but REPORT returns 400: Bad Request. Remove the LimitExcept alltogether and everything works as expected.

Any ideas on why this might be?

(Please see my question here to see what I'm trying to do).

The access log shows: - - [21/Jun/2010:08:42:26 +1000] "REPORT /logs/MV101Apps/!svn/bc/7699/MyApp/MyApps.edp HTTP/1.1" 400 101

The error log shows:

[Mon Jun 21 08:42:26 2010] [error] [client] client denied by server configuration: C:/Program Files/CollabNet/Subversion Server/httpd/htdocs/logs


Ok, a quick inspection reveals that either with or without the <LimitExcept> the REPORT URL stays the same. This is what the log looks like without the <LimitExcept> (everything else in the config stayed the same): - - [22/Jun/2010:21:03:42 +1000] "REPORT /logs/MV101Apps/!svn/bc/7821/MyApp/MyApps.edp HTTP/1.1" 200 115

(note that that URL is a Subversion URL as generated by the command svn log - I'm not the one adding the !svn to it)

The complete VirutalHost for /logs/ looks like this:

<Location /logs/>
   DAV svn
   SVNParentPath C:\SVN
       deny from all
share|improve this question
Got any output in your apache error log? Oh, and adding 'apache' without the '2' might help to get others to see this question. – Wrikken Jun 18 '10 at 13:49
@Wrikken - good thinking, don't know why I didn't already do that. I'll attach it to the question on Monday. – Mark Henderson Jun 18 '10 at 22:59
up vote 3 down vote accepted

This is what the latest mod_dav.c looks like in 2.2.15 (edited for brevity):

static int dav_method_report(request_rec *r)
  int result;
  apr_xml_doc *doc;

  if ((result = ap_xml_parse_input(r, &doc)) != OK)
    return result;
  if (doc == NULL) {
    return HTTP_BAD_REQUEST;

So, my gut instinct is that ap_xml_parse_input(r, &doc)) is leaving doc=NULL; based on not being able to access that questionable doc name (it has a ! in it??) and spitting back a 400:

"REPORT /logs/MV101Apps/!svn/bc/7699/MyApp/MyApps.edp HTTP/1.1"


client denied by server configuration: C:/Program Files/CollabNet/Subversion Server/httpd/htdocs/logs smells like the problem lies in how virtual /logs/ from the access_log is mapped to this directory in error_log, and if there are proper access controls to allow the resources to be read from the location. We need to see all that config info next.

share|improve this answer
Impressive research there, +1 – pauska Jun 22 '10 at 10:27
thinking further, the default value of result in the function ap_xml_parse_input (server/util_xml.c) is HTTP_BAD_REQUEST as well, so it could actually be failing at the initial parsing step. Looking at the function this can be from several different types of read errors as well as parsing... – troyengel Jun 22 '10 at 10:49
Wow, impressive, thanks. Thing is if I remove the <LimitExcept> everything works perfectly, even though no other methods are used besides the three listed. I don't know if the SVN URL stays the same though, I'll need to inspect the logs to find out... – Mark Henderson Jun 22 '10 at 10:56
Just so I can be sure to post the right info (Apache isn't my forte), "We need to see that config info" - which part of the config would you like to see? the /logs/ VirtualHost? – Mark Henderson Jun 22 '10 at 10:58
Could ap_xml_parse_input be re-interrogating Apache and trying to invoke a method that's not included in the <LimitExcept>? – Mark Henderson Jun 22 '10 at 11:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.