Public cannot upload file with mtime set on a public link share with new version of WebDAV API

Steps to reproduce

1. create a user
2. create a folder

curl -u uu0:uu0 -X MKCOL http://localhost/core/remote.php/dav/files/uu0/testFolder

3. share the folder with type public_link and permissions create, read

curl -u uu0:uu0 -X POST http://localhost/core/ocs/v2.php/apps/files_sharing/api/v1/shares -d name='my_public_link' -d path='/testFolder' -d permissions=5 -d shareType=3

Response is as:

<?xml version="1.0"?>
<ocs>
 <meta>
  <status>ok</status>
  <statuscode>200</statuscode>
  <message/>
  <totalitems></totalitems>
  <itemsperpage></itemsperpage>
 </meta>
 <data>
  <id>290</id>
  <share_type>3</share_type>
  <uid_owner>uu0</uid_owner>
  <displayname_owner>uu0</displayname_owner>
  <permissions>5</permissions>
  <stime>1593170769</stime>
  <parent/>
  <expiration/>
  <token>e4VNEAXS1U47jJC</token>
  <uid_file_owner>uu0</uid_file_owner>
  <displayname_file_owner>uu0</displayname_file_owner>
  <additional_info_owner/>
  <additional_info_file_owner/>
  <path>/testFolder</path>
  <item_type>folder</item_type>
  <mimetype>httpd/unix-directory</mimetype>
  <storage_id>home::uu0</storage_id>
  <storage>979</storage>
  <item_source>2147514289</item_source>
  <file_source>2147514289</file_source>
  <file_parent>2147506457</file_parent>
  <file_target>/testFolder</file_target>
  <name>my_public_link</name>
  <url>http://localhost/core/index.php/s/e4VNEAXS1U47jJC</url>
  <mail_send>0</mail_send>
  <attributes/>
 </data>
</ocs>

4. as public user upload a file into the public share without mtime

url -X PUT -H "X-Requested-With:XMLHttpRequest" -u e4VNEAXS1U47jJC:'' http://localhost/core/remote.php/dav/public-files/e4VNEAXS1U47jJC/testFile.txt -d data='is uploaded' -v

The response we got:

<?xml version="1.0"?>
<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns">
  <d:response>
    <d:href>/core/remote.php/dav/public-files/e4VNEAXS1U47jJC/testFile.txt</d:href>
    <d:propstat>
      <d:prop>
        <d:getlastmodified>Fri, 26 Jun 2020 11:29:40 GMT</d:getlastmodified>
        <d:getcontentlength>16</d:getcontentlength>
        <d:resourcetype/>
        <d:getetag>"60b2fe8854bd717338aaf0b864634723"</d:getetag>
        <d:getcontenttype>text/plain</d:getcontenttype>
      </d:prop>
      <d:status>HTTP/1.1 200 OK</d:status>
    </d:propstat>
  </d:response>
</d:multistatus>

It's working as expected

5. as public upload another file into the public share with mtime with old WebDAV API

curl -H "Authorization: Basic c1pEZVZTdkpqSERwbVhhOm51bGw=" -H "X-Requested-With:XMLHttpRequest" -H "X-OC-Mtime: 1565237893" -X PUT http://localhost/core/public.php/webdav/newfilezz55.txt -v
``
The response we got:
```sh
*   Trying 127.0.0.1:80...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 80 (#0)
> PUT /core/public.php/webdav/newfilezz55.txt HTTP/1.1
> Host: localhost
> User-Agent: curl/7.68.0
> Accept: */*
> Authorization: Basic c1pEZVZTdkpqSERwbVhhOm51bGw=
> X-Requested-With:XMLHttpRequest
> X-OC-Mtime: 1565237893
> 
* Mark bundle as not supporting multiuse
< HTTP/1.1 201 Created
< Date: Mon, 29 Jun 2020 07:47:38 GMT
< Server: Apache/2.4.41 (Ubuntu)
< Set-Cookie: octn57k1hjpr=c9sn1hvatmsr8dclpbul0agv2n; path=/core; HttpOnly
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Set-Cookie: oc_sessionPassphrase=p1Tl5B65uyG6lCzA2uigFriaN3xbrH5IA4si3NDTgPx99nj%2FyJTxLVGKXC4ProWnsEVDimwhrJCipeajM1QCyqGKEZYC%2BmV%2Ffcp%2FcAhELgbb6GO0%2Bu9%2Fy0bsQZ4V3Js%2F; path=/core; HttpOnly; SameSite=strict
< Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Robots-Tag: none
< X-Download-Options: noopen
< X-Permitted-Cross-Domain-Policies: none
< X-OC-MTime: accepted
< OC-FileId: 2147514295octn57k1hjpr
< Content-Length: 0
< ETag: "e60696e12a309ff42cec7c4a5448af1f"
< OC-ETag: "e60696e12a309ff42cec7c4a5448af1f"
< Content-Type: text/html; charset=UTF-8
< 
* Connection #0 to host localhost left intact

6. as public user propfind just uploaded file

curl -X PROPFIND http://localhost/core/remote.php/dav/public-files/sZDeVSvJjHDpmXa/newfilezz55.txt | xmllint --format - 

The response we got:

<?xml version="1.0"?>
<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns">
  <d:response>
    <d:href>/core/remote.php/dav/public-files/sZDeVSvJjHDpmXa/newfilezz55.txt</d:href>
    <d:propstat>
      <d:prop>
        <d:getlastmodified>Thu, 08 Aug 2019 04:18:13 GMT</d:getlastmodified>
        <d:getcontentlength>0</d:getcontentlength>
        <d:resourcetype/>
        <d:getetag>"e60696e12a309ff42cec7c4a5448af1f"</d:getetag>
        <d:getcontenttype>text/plain</d:getcontenttype>
      </d:prop>
      <d:status>HTTP/1.1 200 OK</d:status>
    </d:propstat>
  </d:response>
</d:multistatus>

BUT WITH NEW WEBDAV API

7. as public user upload another file into the public share with mtime with new WebDAV API

curl -X PUT -H "X-Requested-With:XMLHttpRequest" -H "X-OC-Mtime: 1565237893" -u e4VNEAXS1U47jJC:'' http://localhost/core/remote.php/dav/public-files/e4VNEAXS1U47jJC/testFile1.txt -d data='is uploaded' -v

The response we got:

*   Trying 127.0.0.1:80...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 80 (#0)
* Server auth using Basic with user 'e4VNEAXS1U47jJC'
> PUT /core/remote.php/dav/public-files/e4VNEAXS1U47jJC/testFile1.txt HTTP/1.1
> Host: localhost
> Authorization: Basic ZTRWTkVBWFMxVTQ3akpDOg==
> User-Agent: curl/7.68.0
> Accept: */*
> X-Requested-With:XMLHttpRequest
> X-OC-Mtime: 1565237893
> Content-Length: 16
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 16 out of 16 bytes
* Mark bundle as not supporting multiuse
< HTTP/1.1 201 Created
< Date: Fri, 26 Jun 2020 11:34:56 GMT
< Server: Apache/2.4.41 (Ubuntu)
< Set-Cookie: octn57k1hjpr=9sbh8artuls9q58hrs6cbrli0l; path=/core; HttpOnly
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Set-Cookie: oc_sessionPassphrase=SUSXorUqccejSW8MS2DXnhnATN69ePLS5rdL1JOthA5z9l%2FeqmxcPUEtdygoILQWNkfVow78rHSJLc7wttH7asUevR2vOdmIUnwnxYOpx%2BoKjN%2BJOubIW%2B2mq4VY4XHn; pat31h=/core; HttpOnly; SameSite=strict
< Content-Security-Policy: default-src 'none';
< X-XSS-Protection: 1; mode=block
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Robots-Tag: none
< X-Download-Options: noopen
< X-Permitted-Cross-Domain-Policies: none
< Content-Length: 0
< ETag: "d3d1ac4a8b9fca5f90e3de0167a68ae8"
< OC-ETag: "d3d1ac4a8b9fca5f90e3de0167a68ae8"
< Content-Type: text/html; charset=UTF-8
< 
* Connection #0 to host localhost left intact

6. now propfind for the new uploaded file

<?xml version="1.0"?>
<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns">
  <d:response>
    <d:href>/core/remote.php/dav/public-files/e4VNEAXS1U47jJC/testFile1.txt</d:href>
    <d:propstat>
      <d:prop>
        <d:getlastmodified>Fri, 26 Jun 2020 11:34:56 GMT</d:getlastmodified>
        <d:getcontentlength>16</d:getcontentlength>
        <d:resourcetype/>
        <d:getetag>"d3d1ac4a8b9fca5f90e3de0167a68ae8"</d:getetag>
        <d:getcontenttype>text/plain</d:getcontenttype>
      </d:prop>
      <d:status>HTTP/1.1 200 OK</d:status>
    </d:propstat>
  </d:response>
</d:multistatus>

Notice the d:getlastmodified element in the response XML, the value is set with recent time, not as set mtime in file upload request

Expected behaviour

If public user uploads file with mtime on the public share from old/new webdav api, the mtime should be preserved.

Actual behaviour

mtime is not preserved

Server configuration

latest core master

Start by reproducing the PUT and PROPFIND requests against remote.php/dav/public-files, then compare how X-OC-Mtime is handled by public.php/webdav and the newer endpoint. Trace the public-share upload path and add regression coverage; done means the requested mtime is preserved and returned in d:getlastmodified for the new API.