owncloud / owncloud/core

Autorename doesnot works by default when uploading file in the public link with upload only permission using the old webdav api

Open
#36,356 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type:Bug
Dominant language
PHP
Stars
8.8k
Forks
2.1k
Avg merge
20h 7m
Merged PRs (30d)
41

Description

Steps to reproduce
  1. Create a public link with upload only permission.
  2. upload a file to the public link eg. test.txt
  3. Using the old public webdav api try to upload another file with same name (test.txt)
curl http://owncloud/public.php/webdav/test.txt -u j5rdmu8P43xtp4o:"" -X PUT -H "Content-Type: text/plain" --data-raw 'hello world' -v
Expected behaviour

The file should be uploaded with new name (eg. test (2).txt, That is the current behavior when using the new public webdav api)

edit : Looks like the renaming is only possible when setting header OC-Autorename: 1. But since it is a default behavior in the new public webDAV API, Shouldn't it be the same in the old one.

Actual behaviour

We get http 403 and the file is not uploaded.
The user gets following response and the file is not created.

<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\Forbidden</s:exception>
  <s:message/>
</d:error>
Server configuration

Operating system: ubuntu 18.04

Web server: apache

Database: mysql

PHP version: 7.2

ownCloud version: (see ownCloud admin page) ownCloud 10.3.0 (git)

Updated from an older ownCloud or fresh install: fresh

Where did you install ownCloud from: git

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the public.php/webdav endpoint and reproduce the duplicate upload using the provided curl command, comparing it with the new public WebDAV API behavior. Trace how the upload-only public link handles the OC-Autorename header in the old API. Done means a second test.txt upload receives an automatic new name instead of HTTP 403.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.