[Bug]: Drag and drop folder uploads to share links fail (PROPFIND)

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Hi,

after updating to v32.0.3 I thought I'd test uploading files again.
Chunked uploading now works (yay!), but uploading folders via drag and drop is not possible now.

In all cases this is due to the browser making a PROPFIND request before uploading the folder. Maybe this also somehow relates to https://github.com/nextcloud/server/issues/57021?

The error messages are different, depending on the permissions selected:

1. If it's a true file drop share (only create permission is set) the server returns 405 and Only PUT, MKCOL and MOVE are allowed on files drop. As a consequence, PROPFIND fails.
2. If one adds the read permission, in response to PROPFIND the server first returns 404 File with name //$nameOfFolderToBeUploaded could not be located. Of course, this kind of makes sense, because, well, I'm trying to upload the folder, so obviously it doesn't exist yet. So probably it's wrong to do PROPFILE here in the first place.

I've attached the log messages below.

Again, note that this only applies to uploading via drag and drop. When selecting + New or + Upload and then choosing Upload folder, everything works fine.

This was tested in Chrome and Safari (macOS, both latest version).

Steps to reproduce

1. Create a share link with at leaset the create permission
2. Open the link
3. Drag and drop a folder
4. Notice that upload fails

Expected behavior

Folder upload works even with drag and drop

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

irrelevant

List of activated Apps

irrelevant

Nextcloud Signing status

irrelevant

Nextcloud Logs

1. Read permission unset (only create):

{
	"reqId": "pOpccII3zsX0Zel2w5EV",
	"level": 0,
	"time": "2025-12-12T03:03:58+01:00",
	"remoteAddr": "REDACTED",
	"user": "--",
	"app": "webdav",
	"method": "PROPFIND",
	"url": "/public.php/dav/files/$someID/$nameOfFolderToBeUploaded",
	"message": "Only PUT, MKCOL and MOVE are allowed on files drop",
	"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
	"version": "32.0.3.2",
	"exception": {
		"Exception": "Sabre\\DAV\\Exception\\MethodNotAllowed",
		"Message": "Only PUT, MKCOL and MOVE are allowed on files drop",
		"Code": 0,
		"Trace": [
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
				"line": 89,
				"function": "beforeMethod",
				"class": "OCA\\DAV\\Files\\Sharing\\FilesDropPlugin",
				"type": "->",
				"args": [
					{
						"__class__": "Sabre\\HTTP\\Request"
					},
					{
						"__class__": "Sabre\\HTTP\\Response"
					}
				]
			},
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 456,
				"function": "emit",
				"class": "Sabre\\DAV\\Server",
				"type": "->",
				"args": [
					"beforeMethod:PROPFIND",
					[
						{
							"__class__": "Sabre\\HTTP\\Request"
						},
						{
							"__class__": "Sabre\\HTTP\\Response"
						}
					]
				]
			},
			{
				"file": "/opt/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php",
				"line": 211,
				"function": "invokeMethod",
				"class": "Sabre\\DAV\\Server",
				"type": "->",
				"args": [
					{
						"__class__": "Sabre\\HTTP\\Request"
					},
					{
						"__class__": "Sabre\\HTTP\\Response"
					}
				]
			},
			{
				"file": "/opt/www/nextcloud/apps/dav/appinfo/v2/publicremote.php",
				"line": 160,
				"function": "start",
				"class": "OCA\\DAV\\Connector\\Sabre\\Server",
				"type": "->",
				"args": []
			},
			{
				"file": "/opt/www/nextcloud/public.php",
				"line": 90,
				"args": [
					"/opt/www/nextcloud/apps/dav/appinfo/v2/publicremote.php"
				],
				"function": "require_once"
			}
		],
		"File": "/opt/www/nextcloud/apps/dav/lib/Files/Sharing/FilesDropPlugin.php",
		"Line": 87,
		"message": "Only PUT, MKCOL and MOVE are allowed on files drop",
		"exception": {},
		"CustomMessage": "Only PUT, MKCOL and MOVE are allowed on files drop"
	}
}

---

2. Read permission set:

{
	"reqId": "vSHrxjCVgTt4K85DXDpL",
	"level": 0,
	"time": "2025-12-12T03:42:37+01:00",
	"remoteAddr": "REDACTED",
	"user": "--",
	"app": "webdav",
	"method": "PROPFIND",
	"url": "/public.php/dav/files/$someID/$nameOfFolderToBeUploaded/",
	"message": "File with name //$nameOfFolderToBeUploaded could not be located",
	"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36",
	"version": "32.0.3.2",
	"exception": {
		"Exception": "Sabre\\DAV\\Exception\\NotFound",
		"Message": "File with name //$nameOfFolderToBeUploaded could not be located",
		"Code": 0,
		"Trace": [
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php",
				"line": 95,
				"function": "getChild",
				"class": "OCA\\DAV\\Connector\\Sabre\\Directory",
				"type": "->",
				"args": [
					"$nameOfFolderToBeUploaded"
				]
			},
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 971,
				"function": "getNodeForPath",
				"class": "Sabre\\DAV\\Tree",
				"type": "->",
				"args": [
					"files/$someID/$nameOfFolderToBeUploaded"
				]
			},
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 1664,
				"function": "getPropertiesIteratorForPath",
				"class": "Sabre\\DAV\\Server",
				"type": "->",
				"args": [
					"files/$someID/$nameOfFolderToBeUploaded",
					[
						"{DAV:}getcontentlength",
						"{DAV:}getcontenttype",
						"{DAV:}getetag",
						"{DAV:}getlastmodified",
						"{DAV:}creationdate",
						"{DAV:}displayname",
						"{DAV:}quota-available-bytes",
						"{DAV:}resourcetype",
						"{http://nextcloud.org/ns}has-preview",
						"{http://nextcloud.org/ns}is-encrypted",
						"{http://nextcloud.org/ns}mount-type",
						"{http://owncloud.org/ns}comments-unread",
						"{http://owncloud.org/ns}favorite",
						"{http://owncloud.org/ns}fileid",
						"{http://owncloud.org/ns}owner-display-name",
						"{http://owncloud.org/ns}owner-id",
						"{http://owncloud.org/ns}permissions",
						"{http://owncloud.org/ns}size",
						"{http://nextcloud.org/ns}hidden",
						"{http://nextcloud.org/ns}is-mount-root",
						"{http://nextcloud.org/ns}metadata-blurhash",
						"{http://nextcloud.org/ns}metadata-files-live-photo",
						"{http://nextcloud.org/ns}note",
						"{http://nextcloud.org/ns}sharees",
						"{http://nextcloud.org/ns}hide-download",
						"{http://nextcloud.org/ns}share-attributes",
						"{http://owncloud.org/ns}share-types",
						"{http://open-collaboration-services.org/ns}share-permissions",
						"{http://nextcloud.org/ns}rich-workspace",
						"{http://nextcloud.org/ns}rich-workspace-file"
					],
					1
				]
			},
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 1649,
				"function": "writeMultiStatus",
				"class": "Sabre\\DAV\\Server",
				"type": "->",
				"args": [
					{
						"__class__": "Sabre\\Xml\\Writer",
						"elementMap": [],
						"contextUri": "/public.php/dav/",
						"namespaceMap": {
							"DAV:": "d",
							"http://sabredav.org/ns": "s",
							"http://owncloud.org/ns": "oc",
							"http://nextcloud.org/ns": "nc"
						},
						"classMap": []
					},
					{
						"__class__": "Generator"
					},
					false
				]
			},
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php",
				"line": 346,
				"function": "generateMultiStatus",
				"class": "Sabre\\DAV\\Server",
				"type": "->",
				"args": [
					{
						"__class__": "Generator"
					},
					false
				]
			},
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
				"line": 89,
				"function": "httpPropFind",
				"class": "Sabre\\DAV\\CorePlugin",
				"type": "->",
				"args": [
					{
						"__class__": "Sabre\\HTTP\\Request"
					},
					{
						"__class__": "Sabre\\HTTP\\Response"
					}
				]
			},
			{
				"file": "/opt/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php",
				"line": 472,
				"function": "emit",
				"class": "Sabre\\DAV\\Server",
				"type": "->",
				"args": [
					"method:PROPFIND",
					[
						{
							"__class__": "Sabre\\HTTP\\Request"
						},
						{
							"__class__": "Sabre\\HTTP\\Response"
						}
					]
				]
			},
			{
				"file": "/opt/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php",
				"line": 211,
				"function": "invokeMethod",
				"class": "Sabre\\DAV\\Server",
				"type": "->",
				"args": [
					{
						"__class__": "Sabre\\HTTP\\Request"
					},
					{
						"__class__": "Sabre\\HTTP\\Response"
					}
				]
			},
			{
				"file": "/opt/www/nextcloud/apps/dav/appinfo/v2/publicremote.php",
				"line": 160,
				"function": "start",
				"class": "OCA\\DAV\\Connector\\Sabre\\Server",
				"type": "->",
				"args": []
			},
			{
				"file": "/opt/www/nextcloud/public.php",
				"line": 90,
				"args": [
					"/opt/www/nextcloud/apps/dav/appinfo/v2/publicremote.php"
				],
				"function": "require_once"
			}
		],
		"File": "/opt/www/nextcloud/apps/dav/lib/Connector/Sabre/Directory.php",
		"Line": 210,
		"message": "File with name //$nameOfFolderToBeUploaded could not be located",
		"exception": {},
		"CustomMessage": "File with name //$nameOfFolderToBeUploaded could not be located"
	}
}

Additional info

No response