owncloud / owncloud/ocis

COPY a file into same folder with same name returns 204 instead of 403

Open
#1,977 7 comments 0 reactions 0 assignees View on GitHub
Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## In oCIS
```bash
curl -X COPY -u admin:admin https://localhost:9200/remote.php/webdav/parent.txt \
-H "Destination: https://localhost:9200/remote.php/webdav/parent.txt" -v
```
Response
```XML
> COPY /remote.php/webdav/parent.txt HTTP/1.1
> Host: localhost:9200
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.68.0
> Accept: */*
> Destination: https://localhost:9200/remote.php/webdav/parent.txt
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Mark bundle as not supporting multiuse
< HTTP/1.1 204 No Content
< Access-Control-Allow-Origin: *
< Content-Security-Policy: default-src 'none';
< Date: Wed, 28 Apr 2021 05:14:03 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Download-Options: noopen
< X-Frame-Options: SAMEORIGIN
< X-Permitted-Cross-Domain-Policies: none
< X-Robots-Tag: none
< X-Xss-Protection: 1; mode=block
```

## In oC10
```bash
curl -X COPY -u admin:admin http://localhost/core/remote.php/webdav/parent.txt \
-H "Destination: http://localhost/core/remote.php/webdav/parent.txt" -v
```
Response
```XML
> COPY /core/remote.php/webdav/parent.txt HTTP/1.1
> Host: localhost
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.68.0
> Accept: */*
> Destination: http://localhost/core/remote.php/webdav/parent.txt
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< Date: Wed, 28 Apr 2021 05:08:54 GMT
< Server: Apache/2.4.41 (Ubuntu)
< X-Content-Type-Options: nosniff
< X-XSS-Protection: 0
< X-Robots-Tag: none
< X-Frame-Options: SAMEORIGIN
< X-Download-Options: noopen
< X-Permitted-Cross-Domain-Policies: none
< Set-Cookie: ocjtwb0rhxgi=92uqe4quesp5daoc8706ajc46k; path=/core; HttpOnly; SameSite=Strict
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Set-Cookie: oc_sessionPassphrase=iOXvB5YyFU0aYROLIjX%2FxUb90kaoe8YP1OcCguMIpI3IBeuZn7YaqN51HQJh39Xkp3xTJgQf8BFoL1gUSDc8aUmlZWnrEqvFfAY3ZUezXlStV7MqvgVpn55fCb5XWFCM; path=/core; HttpOnly; SameSite=Strict
< Content-Security-Policy: default-src 'none';
< Set-Cookie: ocjtwb0rhxgi=anq8jvbfccrj1tci9t4547ju1p; path=/core; HttpOnly; SameSite=Strict
< Set-Cookie: cookie_test=test; expires=Wed, 28-Apr-2021 06:08:54 GMT; Max-Age=3600
< Content-Length: 234
< Content-Type: application/xml; charset=utf-8
<

Sabre\DAV\Exception\Forbidden
Source and destination uri are identical.

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.