owncloud / owncloud/ocis

sending MKCOL requests to another or non-existing user's webDav endpoints as normal user should return 404

Open
#5,049 0 comments 0 reactions 0 assignees View on GitHub
Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 2h
Merged PRs (30d)
106

Description

## Steps to reproduce

Steps to reproduce the behavior:

1. As user `admin` send `MKCOL` request to another user's endpoint
`curl -vk -X MKCOL -u admin:admin http://localhost/core/remote.php/dav/files/anu/Test | xmllint --format -`

2. As user `admin` send `MKCOL` request to non-existing user's endpoint
`curl -vk -X MKCOL -u admin:admin http://localhost/core/remote.php/dav/files/nonexistent/Test | xmllint --format -`

## Expected behavior
the status code should be `404`. Visit this lInk https://github.com/owncloud/ocis/issues/3872#issuecomment-1305606009 for more info

## Actual behavior
- Returns status `409` for existing user
- Return status `409` non-existen user

curl -vk -X MKCOL -u admin:admin https://host.docker.internal:9200/remote.php/dav/files/non1/abc/ | xmllint --format -

```
curl -vk -X MKCOL -u admin:admin https://host.docker.internal:9200/remote.php/dav/files/non1/abc/ | xmllint --format -

* Mark bundle as not supporting multiuse
< HTTP/1.1 409 Conflict
< Access-Control-Allow-Origin: *
< Content-Length: 221
< Content-Security-Policy: default-src 'none';
< Content-Type: text/xml; charset=utf-8
< Date: Mon, 14 Nov 2022 06:17:16 GMT
< X-Content-Type-Options: nosniff
< X-Download-Options: noopen
< X-Frame-Options: SAMEORIGIN
< X-Permitted-Cross-Domain-Policies: none
< X-Robots-Tag: none
< X-Xss-Protection: 1; mode=block
<
{ [221 bytes data]
100 221 100 221 0 0 2483 0 --:--:-- --:--:-- --:--:-- 2483
* Connection #0 to host host.docker.internal left intact

Sabre\DAV\Exception\Conflict
intermediate collection does not exist

```

Contributor guide

Open the contributing guide

Research direction

Reproduce the reported MKCOL requests against existing and nonexistent user paths, then trace the WebDAV request handling and the intermediate-collection error. Done means both cases return HTTP 404 instead of 409, with the existing response behavior covered by an appropriate test.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.