WebDAV: MKCOL in non edit shared folder returns HTTP result code 201

[dragotin]

This is about a read-only shared folder, that appears in the Shared directory. If I do the WebDAV command MKCOL there to create a new directory, the server replies with status code 201, which means created. However, the directory is not created, which is correct, because the share is read only. But the server should rather return with 403 Forbidden for example.

Easily reproducable with a webdav client, just open a read only shared dir and try MKCOL.

[blizzz]

Blind guess: what happens if you put "return " in front of this line? https://github.com/owncloud/core/blob/master/lib/connector/sabre/directory.php#L110

[blizzz]

or probaby not, if it is what is called by DAV/FS/Directory.php then the return value is not considered anyway.

Maybe we need to throw an Exception, i am not too familiar with Sabre. Maybe @icewind1991 or @butonic know better?

[blizzz]

okay, when more while i am browsing through this.
We could check the return value of the line quoted above and on false either throw Sabre_DAV_Exception_Forbidden (resulting in HTTP 403) or Sabre_DAV_Exception_MethodNotAllowed (HTTP 405) or Sabre_DAV_Exception_PreconditionFailed (HTTP 412). Whatever makes most sense of a general error in this case.

Btw, why does Sabre not implement HTTP 418?

[DeepDiver1975]

according to http://www.webdav.org/specs/rfc4918.html#METHOD_MKCOL we should return 403

[DeepDiver1975]

Btw, why does Sabre not implement HTTP 418?

@evert 😄

[evert]

It's there!

https://github.com/evert/SabreDAV/blob/master/lib/Sabre/HTTP/Response.php#L75

[blizzz]

@evert I meant it did not found return of 418 (just grep'ed through em files) ;)

[blizzz]

So instead of \OC\Files\Filesystem::mkdir($newPath) we would write

if(!\OC\Files\Filesystem::mkdir($newPath)) {
  throw new Sabre_DAV_Exception_Forbidden('Could not create directory '.$newPath);
}

Does this work, @dragotin ?

[dragotin]

Does this work, @dragotin ?
Yes, that works. Great!

Please commit that!

[blizzz]

Great, there you go!