REPORT request to dav endpoints without `remote.php` returns 405 method not allowed

Open

#6,954 opened on Aug 3, 2023 5 comments 0 reactions 0 assignees View on GitHub

Type:Bug

Dominant language: Go
Stars: 2.1k
Forks: 274
Avg merge: 2d 1h
Merged PRs (30d): 103

Description

## Describe the bug

When making API request to search a file by tag and not using `remote.php` in the destination URL, then we get the following results:
- for `new` and `old` dav path version it returns status code `405`
- for `spaces` dev path version it returns files only from personal spaces

## Steps to reproduce

Steps to reproduce the behavior:

1. Create a file `personalFile.txt` in personal space
2. Create a space `Project`
3. Create a file `space.txt` inside project space `Project`
4. Asign a tag `tag1` in both file `personalFile.txt` and `space.txt`
5. Search a file using tag `tag1` with following curl command in different dav path version:

for old dav path version:

```bash
curl -kv -XREPORT https://localhost:9200/webdav \
-u admin:admin \
-d "

Tags:tag1

" | xmllint --format -
```

for new dav path version:

```bash

curl -kv -XREPORT https://localhost:9200/dav/files/admin \
-u admin:admin \
-d "

Tags:tag1

" | xmllint --format -

```

for spaces dav path version:

```bash

curl -kv -XREPORT https://localhost:9200/dav/spaces/ \
-u admin:admin \
-d "

Tags:tag1

" | xmllint --format -

```

## Expected behavior
The expected response should be same as using `remote.php` in the endpoint

for old dav path version:

```xml
< HTTP/1.1 207 Multi-Status
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate, value
< Content-Length: 1847
< Content-Range: rows 0-1/2
< Content-Security-Policy: frame-ancestors 'none'
< Content-Type: application/xml; charset=utf-8
< Date: Thu, 03 Aug 2023 06:38:09 GMT
< Dav: 1, 3, extended-mkcol
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Last-Modified: Thu, 03 Aug 2023 06:38:09 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Frame-Options: DENY
< X-Request-Id: nabin-OptiPlex-3050/u2704Ztkec-002986
< X-Webdav-Version: 3.1.0-beta.1+92d94afb20
<
{ [627 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
100 2033 100 1847 100 186 23774 2394 --:--:-- --:--:-- --:--:-- 26402
* Connection #0 to host localhost left intact

/remote.php/dav/spaces/9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$ee621d91-9363-4164-a970-775b4eefed74/space.txt

9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$ee621d91-9363-4164-a970-775b4eefed74!383e22e5-35d6-43be-aa9a-1fe6b0c72e2e
9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$ee621d91-9363-4164-a970-775b4eefed74!ee621d91-9363-4164-a970-775b4eefed74
space.txt
2023-08-03T06:37:04Z
text/plain
RDNVW

tag1

0
5.363422393798828

HTTP/1.1 200 OK

/remote.php/dav/spaces/9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$faa55102-57df-4539-8a4a-5a1b03560e89/personal.txt

9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$faa55102-57df-4539-8a4a-5a1b03560e89!f6b497f9-9e0a-4d0b-83dd-cfcdc3f949d3
9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$faa55102-57df-4539-8a4a-5a1b03560e89!faa55102-57df-4539-8a4a-5a1b03560e89
personal.txt
2023-08-02T09:32:53Z
text/plain
RDNVW

tag1

5
4.950923442840576

HTTP/1.1 200 OK

```

for new dav path version:

```xml

< HTTP/1.1 207 Multi-Status
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate, value
< Content-Length: 1847
< Content-Range: rows 0-1/2
< Content-Security-Policy: frame-ancestors 'none'
< Content-Type: application/xml; charset=utf-8
< Date: Thu, 03 Aug 2023 06:40:10 GMT
< Dav: 1, 3, extended-mkcol
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Last-Modified: Thu, 03 Aug 2023 06:40:10 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Frame-Options: DENY
< X-Request-Id: nabin-OptiPlex-3050/u2704Ztkec-002988
< X-Webdav-Version: 3.1.0-beta.1+92d94afb20
<
{ [627 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
100 2033 100 1847 100 186 23867 2403 --:--:-- --:--:-- --:--:-- 26402
* Connection #0 to host localhost left intact

```

for spaces dav path version:

```xml

< HTTP/1.1 207 Multi-Status
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate, value
< Content-Length: 1847
< Content-Range: rows 0-1/2
< Content-Security-Policy: frame-ancestors 'none'
< Content-Type: application/xml; charset=utf-8
< Date: Thu, 03 Aug 2023 06:41:59 GMT
< Dav: 1, 3, extended-mkcol
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Last-Modified: Thu, 03 Aug 2023 06:41:59 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Frame-Options: DENY
< X-Request-Id: nabin-OptiPlex-3050/u2704Ztkec-002990
< X-Webdav-Version: 3.1.0-beta.1+92d94afb20
<
{ [627 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
100 2033 100 1847 100 186 24772 2494 --:--:-- --:--:-- --:--:-- 27472
* Connection #0 to host localhost left intact

```

## Actual behavior

for old dav path version:

```xml

< HTTP/1.1 405 Method Not Allowed
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate, value
< Content-Length: 0
< Content-Security-Policy: frame-ancestors 'self'
< Date: Thu, 03 Aug 2023 06:43:21 GMT
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Last-Modified: Thu, 03 Aug 2023 06:43:21 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Request-Id: nabin-OptiPlex-3050/u2704Ztkec-003066
< X-Web-Version: 3.1.0-beta.1+92d94afb20

```

for new new path version:

```xml

< HTTP/1.1 405 Method Not Allowed
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate, value
< Content-Length: 0
< Content-Security-Policy: frame-ancestors 'self'
< Date: Thu, 03 Aug 2023 06:48:08 GMT
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Last-Modified: Thu, 03 Aug 2023 06:48:08 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Frame-Options: SAMEORIGIN
< X-Request-Id: nabin-OptiPlex-3050/u2704Ztkec-003142
< X-Web-Version: 3.1.0-beta.1+92d94afb20

```

for spaces new path version:

```xml

< HTTP/1.1 207 Multi-Status
< Cache-Control: no-cache, no-store, max-age=0, must-revalidate, value
< Content-Length: 1847
< Content-Range: rows 0-1/2
< Content-Security-Policy: frame-ancestors 'none'
< Content-Type: application/xml; charset=utf-8
< Date: Thu, 03 Aug 2023 06:49:43 GMT
< Dav: 1, 3, extended-mkcol
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Last-Modified: Thu, 03 Aug 2023 06:49:43 GMT
< Vary: Origin
< X-Content-Type-Options: nosniff
< X-Frame-Options: DENY
< X-Request-Id: nabin-OptiPlex-3050/u2704Ztkec-003146
< X-Webdav-Version: 3.1.0-beta.1+92d94afb20
<
{ [627 bytes data]
* TLSv1.2 (IN), TLS header, Supplemental data (23):
{ [5 bytes data]
100 2033 100 1847 100 186 24731 2490 --:--:-- --:--:-- --:--:-- 27472
* Connection #0 to host localhost left intact

/remote.php/dav/spaces/9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$faa55102-57df-4539-8a4a-5a1b03560e89/personal.txt

9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$faa55102-57df-4539-8a4a-5a1b03560e89!f6b497f9-9e0a-4d0b-83dd-cfcdc3f949d3
9f9fbd5f-3099-4eae-a3b4-e3ab1b939902$faa55102-57df-4539-8a4a-5a1b03560e89!faa55102-57df-4539-8a4a-5a1b03560e89
personal.txt
2023-08-02T09:32:53Z
text/plain
RDNVW

tag1

5
4.950923442840576

HTTP/1.1 200 OK

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

REPORT request to dav endpoints without `remote.php` returns 405 method not allowed

Description

Contributor guide

Assessment

Get new issues in your inbox