From bfff4fbc3f8d81a7f05b5bde87f0997b480201aa Mon Sep 17 00:00:00 2001 From: Ferdinand Thiessen Date: Wed, 8 Apr 2026 23:09:51 +0200 Subject: [PATCH] fix(dav): do not list intermediate upload folders Signed-off-by: Ferdinand Thiessen --- apps/dav/lib/Upload/RootCollection.php | 1 + apps/dav/lib/Upload/UploadHome.php | 10 ++-------- build/integration/filesdrop_features/filesdrop.feature | 2 +- 3 files changed, 4 insertions(+), 9 deletions(-) diff --git a/apps/dav/lib/Upload/RootCollection.php b/apps/dav/lib/Upload/RootCollection.php index cd7ab7f5e0a..e8dc4daca22 100644 --- a/apps/dav/lib/Upload/RootCollection.php +++ b/apps/dav/lib/Upload/RootCollection.php @@ -26,6 +26,7 @@ class RootCollection extends AbstractPrincipalCollection { private IManager $shareManager, ) { parent::__construct($principalBackend, $principalPrefix); + $this->disableListing = true; } /** diff --git a/apps/dav/lib/Upload/UploadHome.php b/apps/dav/lib/Upload/UploadHome.php index ba1a518bd4b..b5274cbe6fc 100644 --- a/apps/dav/lib/Upload/UploadHome.php +++ b/apps/dav/lib/Upload/UploadHome.php @@ -14,6 +14,7 @@ use OCP\Files\IRootFolder; use OCP\Files\NotFoundException; use OCP\IUserSession; use Sabre\DAV\Exception\Forbidden; +use Sabre\DAV\Exception\MethodNotAllowed; use Sabre\DAV\Exception\NotFound; use Sabre\DAV\ICollection; @@ -62,14 +63,7 @@ class UploadHome implements ICollection { } public function getChildren(): array { - return array_map(function ($node) { - return new UploadFolder( - $node, - $this->cleanupService, - $this->getStorage(), - $this->uid, - ); - }, $this->impl()->getChildren()); + throw new MethodNotAllowed('Listing members of this collection is disabled'); } public function childExists($name): bool { diff --git a/build/integration/filesdrop_features/filesdrop.feature b/build/integration/filesdrop_features/filesdrop.feature index 52a0399f4b4..b606cc53e34 100644 --- a/build/integration/filesdrop_features/filesdrop.feature +++ b/build/integration/filesdrop_features/filesdrop.feature @@ -199,7 +199,7 @@ Scenario: Files drop allow MKCOL without a nickname And Downloading public folder "Mallory/folder" Then the HTTP status code should be "405" And Downloading public file "Mallory/folder/a.txt" - Then the HTTP status code should be "405" + Then the HTTP status code should be "404" Scenario: Files drop requires nickname if file request is enabled Given user "user0" exists