From 3558c886a9010077d85ac63692d7b90b8be65a09 Mon Sep 17 00:00:00 2001 From: jkoberg Date: Thu, 1 Aug 2024 15:07:19 +0200 Subject: [PATCH] Revert "fix(ocdav): block overwriting mountpoints" This reverts commit 77c799c378a5cbf8eb15d765657d8a22cb316626. --- .../block-overwriting-mountpoints.md | 5 ---- internal/http/services/owncloud/ocdav/copy.go | 26 ++++++------------- 2 files changed, 8 insertions(+), 23 deletions(-) delete mode 100644 changelog/unreleased/block-overwriting-mountpoints.md diff --git a/changelog/unreleased/block-overwriting-mountpoints.md b/changelog/unreleased/block-overwriting-mountpoints.md deleted file mode 100644 index a21fe9c01f..0000000000 --- a/changelog/unreleased/block-overwriting-mountpoints.md +++ /dev/null @@ -1,5 +0,0 @@ -Bugfix: Block overwriting mountpoints - -This blocks overwriting mountpoints through the webdav COPY api. It is now returning a bad request when attempting to overwrite a mountpoint. - -https://github.com/cs3org/reva/pull/4785 diff --git a/internal/http/services/owncloud/ocdav/copy.go b/internal/http/services/owncloud/ocdav/copy.go index e19ebd01cb..c009e59789 100644 --- a/internal/http/services/owncloud/ocdav/copy.go +++ b/internal/http/services/owncloud/ocdav/copy.go @@ -127,7 +127,7 @@ func (s *svc) handlePathCopy(w http.ResponseWriter, r *http.Request, ns string) return } - cp := s.prepareCopy(ctx, w, r, spacelookup.MakeRelativeReference(srcSpace, src, false), spacelookup.MakeRelativeReference(dstSpace, dst, false), &sublog, dstSpace.GetRoot().GetStorageId() == utils.ShareStorageProviderID) + cp := s.prepareCopy(ctx, w, r, spacelookup.MakeRelativeReference(srcSpace, src, false), spacelookup.MakeRelativeReference(dstSpace, dst, false), &sublog) if cp == nil { return } @@ -362,7 +362,7 @@ func (s *svc) handleSpacesCopy(w http.ResponseWriter, r *http.Request, spaceID s return } - cp := s.prepareCopy(ctx, w, r, &srcRef, &dstRef, &sublog, dstRef.GetResourceId().GetStorageId() == utils.ShareStorageProviderID) + cp := s.prepareCopy(ctx, w, r, &srcRef, &dstRef, &sublog) if cp == nil { return } @@ -552,7 +552,7 @@ func (s *svc) executeSpacesCopy(ctx context.Context, w http.ResponseWriter, sele return nil } -func (s *svc) prepareCopy(ctx context.Context, w http.ResponseWriter, r *http.Request, srcRef, dstRef *provider.Reference, log *zerolog.Logger, destInShareJail bool) *copy { +func (s *svc) prepareCopy(ctx context.Context, w http.ResponseWriter, r *http.Request, srcRef, dstRef *provider.Reference, log *zerolog.Logger) *copy { isChild, err := s.referenceIsChildOf(ctx, s.gatewaySelector, dstRef, srcRef) if err != nil { switch err.(type) { @@ -675,6 +675,11 @@ func (s *svc) prepareCopy(ctx context.Context, w http.ResponseWriter, r *http.Re if dstStatRes.Status.Code == rpc.Code_CODE_OK { successCode = http.StatusNoContent // 204 if target already existed, see https://tools.ietf.org/html/rfc4918#section-9.8.5 + if utils.IsSpaceRoot(dstStatRes.GetInfo()) { + log.Error().Msg("overwriting is not allowed") + w.WriteHeader(http.StatusBadRequest) + return nil + } if !overwrite { log.Warn().Bool("overwrite", overwrite).Msg("dst already exists") w.WriteHeader(http.StatusPreconditionFailed) @@ -683,21 +688,6 @@ func (s *svc) prepareCopy(ctx context.Context, w http.ResponseWriter, r *http.Re errors.HandleWebdavError(log, w, b, err) // 412, see https://tools.ietf.org/html/rfc4918#section-9.8.5 return nil } - - if utils.IsSpaceRoot(dstStatRes.GetInfo()) { - log.Error().Msg("overwriting is not allowed") - w.WriteHeader(http.StatusBadRequest) - return nil - } - - // we must not allow to override mountpoints - so we check if we have access to the parent. If not this is a mountpoint - if destInShareJail { - log.Error().Msg("must not overwrite mount points") - w.WriteHeader(http.StatusBadRequest) - _, _ = w.Write([]byte("must not overwrite mount points")) - return nil - } - // delete existing tree when overwriting a directory or replacing a file with a directory if dstStatRes.Info.Type == provider.ResourceType_RESOURCE_TYPE_CONTAINER || (dstStatRes.Info.Type == provider.ResourceType_RESOURCE_TYPE_FILE &&