upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-22 14:50:17 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 53

Merge pull request #49966 from nextcloud/block-dav-move-parent

Browse source 
fix: block moving files to it's own parent with dav
This commit is contained in:
Stephan Orbaugh 2025-01-07 10:24:06 +01:00 committed by GitHub
commit b64b106c13
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
apps/dav/lib/Connector/Sabre/FilesPlugin.php
View file

@ -203,6 +203,11 @@ class FilesPlugin extends ServerPlugin {
if (!$sourceNodeFileInfo->isDeletable()) {
throw new Forbidden($source . ' cannot be deleted');
}
// The source is not allowed to be the parent of the target
if (str_starts_with($source, $target . '/')) {
throw new Forbidden($source . ' cannot be moved to it\'s parent');
}
}
/**

10
build/integration/dav_features/dav-v2.feature
View file

@ -12,6 +12,16 @@ Feature: dav-v2
When User "user0" moves file "/textfile0.txt" to "/FOLDER/textfile0.txt"
Then the HTTP status code should be "201"
Scenario: Moving and overwriting it's parent
Given using new dav path
And As an "admin"
And user "user0" exists
And As an "user0"
And user "user0" created a folder "/test"
And user "user0" created a folder "/test/test"
When User "user0" moves file "/test/test" to "/test"
Then the HTTP status code should be "403"
Scenario: download a file with range using new endpoint
Given using new dav path
And As an "admin"

10
build/integration/dav_features/webdav-related.feature
View file

@ -38,6 +38,16 @@ Feature: webdav-related
Then the HTTP status code should be "204"
And Downloaded content when downloading file "/textfile0.txt" with range "bytes=0-6" should be "Welcome"
Scenario: Moving and overwriting it's parent
Given using old dav path
And As an "admin"
And user "user0" exists
And As an "user0"
And user "user0" created a folder "/test"
And user "user0" created a folder "/test/test"
When User "user0" moves file "/test/test" to "/test"
Then the HTTP status code should be "403"
Scenario: Moving a file to a folder with no permissions
Given using old dav path
And As an "admin"