COPY a file into same folder with same name returns 204 instead of 403
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 274
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 103
Description
## In oCIS
```bash
curl -X COPY -u admin:admin https://localhost:9200/remote.php/webdav/parent.txt \
-H "Destination: https://localhost:9200/remote.php/webdav/parent.txt" -v
```
Response
```XML
> COPY /remote.php/webdav/parent.txt HTTP/1.1
> Host: localhost:9200
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.68.0
> Accept: */*
> Destination: https://localhost:9200/remote.php/webdav/parent.txt
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Mark bundle as not supporting multiuse
< HTTP/1.1 204 No Content
< Access-Control-Allow-Origin: *
< Content-Security-Policy: default-src 'none';
< Date: Wed, 28 Apr 2021 05:14:03 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Download-Options: noopen
< X-Frame-Options: SAMEORIGIN
< X-Permitted-Cross-Domain-Policies: none
< X-Robots-Tag: none
< X-Xss-Protection: 1; mode=block
```
## In oC10
```bash
curl -X COPY -u admin:admin http://localhost/core/remote.php/webdav/parent.txt \
-H "Destination: http://localhost/core/remote.php/webdav/parent.txt" -v
```
Response
```XML
> COPY /core/remote.php/webdav/parent.txt HTTP/1.1
> Host: localhost
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.68.0
> Accept: */*
> Destination: http://localhost/core/remote.php/webdav/parent.txt
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< Date: Wed, 28 Apr 2021 05:08:54 GMT
< Server: Apache/2.4.41 (Ubuntu)
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 0
< X-Robots-Tag: none
< X-Frame-Options: SAMEORIGIN
< X-Download-Options: noopen
< X-Permitted-Cross-Domain-Policies: none
< Set-Cookie: ocjtwb0rhxgi=92uqe4quesp5daoc8706ajc46k; path=/core; HttpOnly; SameSite=Strict
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Set-Cookie: oc_sessionPassphrase=iOXvB5YyFU0aYROLIjX%2FxUb90kaoe8YP1OcCguMIpI3IBeuZn7YaqN51HQJh39Xkp3xTJgQf8BFoL1gUSDc8aUmlZWnrEqvFfAY3ZUezXlStV7MqvgVpn55fCb5XWFCM; path=/core; HttpOnly; SameSite=Strict
< Content-Security-Policy: default-src 'none';
< Set-Cookie: ocjtwb0rhxgi=anq8jvbfccrj1tci9t4547ju1p; path=/core; HttpOnly; SameSite=Strict
< Set-Cookie: cookie_test=test; expires=Wed, 28-Apr-2021 06:08:54 GMT; Max-Age=3600
< Content-Length: 234
< Content-Type: application/xml; charset=utf-8
<
Sabre\DAV\Exception\Forbidden
Source and destination uri are identical.
```
Contributor guide
Assessment
This issue has not been assessed yet.