diff --git a/changelog/unreleased/fix-ocdav-trashbin-listing.md b/changelog/unreleased/fix-ocdav-trashbin-listing.md new file mode 100644 index 0000000000..eefe5c02d6 --- /dev/null +++ b/changelog/unreleased/fix-ocdav-trashbin-listing.md @@ -0,0 +1,5 @@ +Bugfix: Allow listing the trashbin + +The trashbin endpoint expects the userid, not the username. + +https://github.com/cs3org/reva/pull/1091 \ No newline at end of file diff --git a/internal/http/services/owncloud/ocdav/trashbin.go b/internal/http/services/owncloud/ocdav/trashbin.go index 64823607b5..c10e1d2a86 100644 --- a/internal/http/services/owncloud/ocdav/trashbin.go +++ b/internal/http/services/owncloud/ocdav/trashbin.go @@ -60,10 +60,10 @@ func (h *TrashbinHandler) Handler(s *svc) http.Handler { return } - var username string - username, r.URL.Path = router.ShiftPath(r.URL.Path) + var userid string + userid, r.URL.Path = router.ShiftPath(r.URL.Path) - if username == "" { + if userid == "" { // listing is disabled, no auth will change that w.WriteHeader(http.StatusMethodNotAllowed) return @@ -74,7 +74,8 @@ func (h *TrashbinHandler) Handler(s *svc) http.Handler { w.WriteHeader(http.StatusBadRequest) return } - if u.Username != username { + if u.Id.OpaqueId != userid { + log.Debug().Str("userid", userid).Interface("user", u).Msg("trying to read another users trash") // listing other users trash is forbidden, no auth will change that w.WriteHeader(http.StatusMethodNotAllowed) return @@ -114,7 +115,7 @@ func (h *TrashbinHandler) Handler(s *svc) http.Handler { // find path in url relative to trash base trashBase := ctx.Value(ctxKeyBaseURI).(string) - baseURI := path.Join(path.Dir(trashBase), "files", username) + baseURI := path.Join(path.Dir(trashBase), "files", userid) ctx = context.WithValue(ctx, ctxKeyBaseURI, baseURI) r = r.WithContext(ctx)