upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-28 04:32:30 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 25

fix(dav): do not read intermediate uploads

Browse source 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
This commit is contained in:
Ferdinand Thiessen 2026-04-08 23:09:32 +02:00 committed by backportbot[bot]
parent a7b0c65f8e
commit 96f1135a77
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
apps/dav/lib/Upload/ChunkingV2Plugin.php
View file

@ -46,6 +46,7 @@ use OCP\IConfig;
use OCP\Lock\ILockingProvider;
use Sabre\DAV\Exception\BadRequest;
use Sabre\DAV\Exception\InsufficientStorage;
use Sabre\DAV\Exception\MethodNotAllowed;
use Sabre\DAV\Exception\NotFound;
use Sabre\DAV\Exception\PreconditionFailed;
use Sabre\DAV\ICollection;
@ -84,14 +85,24 @@ class ChunkingV2Plugin extends ServerPlugin {
* @inheritdoc
*/
public function initialize(Server $server) {
$server->on('afterMethod:MKCOL', [$this, 'afterMkcol']);
$server->on('beforeMethod:GET', [$this, 'beforeGet']);
$server->on('beforeMethod:PUT', [$this, 'beforePut']);
$server->on('beforeMethod:DELETE', [$this, 'beforeDelete']);
$server->on('beforeMove', [$this, 'beforeMove'], 90);
$server->on('afterMethod:MKCOL', [$this, 'afterMkcol']);
$this->server = $server;
}
public function beforeGet(RequestInterface $request) {
$sourceNode = $this->server->tree->getNodeForPath($request->getPath());
if (($sourceNode instanceof FutureFile) || ($sourceNode instanceof UploadFile)) {
throw new MethodNotAllowed('Reading intermediate uploads is not allowed');
}
return true;
}
/**
* @param string $path
* @param bool $createIfNotExists