Prevent WebDAV delete of user's files folder

[PVince81]

Steps:

Run curl -D - -X DELETE "http://root:admin@localhost/owncloud/remote.php/webdav/"

Expected result

403 forbidden

Actual result

Internal folder "$user/files" is deleted.
Trashbin contains folder "files".
Getting "contrain violation errors".

We should probably make "isDeletable()" return false on the root folder and also "files".

CC @icewind1991 @schiesbn @nickvergessen

[PVince81]

Note, this can also be achieved using a backslash folder:
curl -D - -X DELETE "http://root:admin@localhost/owncloud/remote.php/webdav/\\"

The folder gets sanitized to "/" which points to the internal "files" folder...

[PVince81]

This also deletes the root:
curl -D - -X MOVE "http://root:admin@localhost/owncloud/remote.php/webdav/" -H 'Destination: http://root:admin@localhost/owncloud/remote.php/webdav/.\\.

Normally it would not accept to MOVE a folder to itself, but semantically the target folder is considered a different folder, so it tries to overwrite it. And overwrite first deletes the destination. So this has the same symptoms.

[PVince81]

@SergioBertolinSG @jnfrmarks something to add to test plans.
Better test any kind of WebDAV operations on the root.

[SergioBertolinSG]

Tried

curl -D - -X DELETE "http://user:passwd@host/remote.php/webdav/\\"

It returned:

?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Doctrine\DBAL\Exception\NotNullConstraintViolationException</s:exception>
  <s:message>An exception occurred while executing 'INSERT INTO "files_trash" ("id","timestamp","location","user") VALUES (?,?,?,?)' with params ["", 1433501523, null, "sergio"]:

SQLSTATE[23502]: Not null violation: 7 ERROR:  null value in column "location" violates not-null constraint
DETAIL:  Failing row contains (10, , sergio, 1433501523, null, null, null).</s:message>
</d:error>

And session gets broken.

[PVince81]

Yes. And after the next login, they get an empty account.

[PVince81]

Similar issue with public WebDAV: #16757

[PVince81]

PR here #16767