owncloud / owncloud/ocis

Renaming resource to banned name is allowed in spaces webdav

Open
#3,099 3 comments 0 reactions 0 assignees View on GitHub
Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## Describe the bug

Renaming a file/folder to the banned name like **` \ `** on spaces webdav is not forbidden

## Steps to reproduce

Steps to reproduce the behavior:

1. create user `uu1`
2. upload file `file.txt` with content `12345`
3. rename the file `file.txt` to `\.txt`
```
curl -X MOVE -uadmin:admin -k https://localhost:9200/remote.php/dav/spaces/{spaceid}/file.txt -H "Destination: https://localhost:9200/remote.php/dav/spaces/{spaceid}/\.txt" -v
```

## Expected behavior
http response 400 Bad request

## Actual behavior
a file with the name `/remote.php/dav/spaces/{spaceid}/%5c.txt` is listed

## Setup

Please describe how you started the server and provide a list of relevant environment variables.

```console
OCIS_VERSION= latest
BRANCH= master

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.