Allow listing the trashbin (#1091)

Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
cs3org · Aug 13, 2020 · 1b82c12 · 1b82c12
1 parent f325194
commit 1b82c12
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 5 deletions.
diff --git a/changelog/unreleased/fix-ocdav-trashbin-listing.md b/changelog/unreleased/fix-ocdav-trashbin-listing.md
@@ -0,0 +1,5 @@
+Bugfix: Allow listing the trashbin
+
+The trashbin endpoint expects the userid, not the username.
+
+https://github.com/cs3org/reva/pull/1091
diff --git a/internal/http/services/owncloud/ocdav/trashbin.go b/internal/http/services/owncloud/ocdav/trashbin.go
@@ -60,10 +60,10 @@ func (h *TrashbinHandler) Handler(s *svc) http.Handler {
  return
  }
 
- var username string
- username, r.URL.Path = router.ShiftPath(r.URL.Path)
+ var userid string
+ userid, r.URL.Path = router.ShiftPath(r.URL.Path)
 
- if username == "" {
+ if userid == "" {
  // listing is disabled, no auth will change that
  w.WriteHeader(http.StatusMethodNotAllowed)
  return
@@ -74,7 +74,8 @@ func (h *TrashbinHandler) Handler(s *svc) http.Handler {
  w.WriteHeader(http.StatusBadRequest)
  return
  }
- if u.Username != username {
+ if u.Id.OpaqueId != userid {
+ log.Debug().Str("userid", userid).Interface("user", u).Msg("trying to read another users trash")
  // listing other users trash is forbidden, no auth will change that
  w.WriteHeader(http.StatusMethodNotAllowed)
  return
@@ -114,7 +115,7 @@ func (h *TrashbinHandler) Handler(s *svc) http.Handler {
 
  // find path in url relative to trash base
  trashBase := ctx.Value(ctxKeyBaseURI).(string)
- baseURI := path.Join(path.Dir(trashBase), "files", username)
+ baseURI := path.Join(path.Dir(trashBase), "files", userid)
  ctx = context.WithValue(ctx, ctxKeyBaseURI, baseURI)
  r = r.WithContext(ctx)