Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sharee (editor role) MOVE a file by file-id into Personal space responds with 502 instead of 403 #8124

Closed
saw-jan opened this issue Jan 4, 2024 · 1 comment

Comments

@saw-jan
Copy link
Member

saw-jan commented Jan 4, 2024

Describe the bug

When a sharee with editor role tries to MOVE a file by file-id as a source into the Personal space root as the destination, the server responds with 502 but it should be 403 like while using file-path.

Trying with sharee with viewer role returns 403.

Steps to reproduce

  1. editor role ❌
curl -XMOVE "https://localhost:9200/remote.php/dav/spaces/<file-id>" \             
-H"Destination: https://localhost:9200/remote.php/dav/spaces/<demo-personal-space-id>/file.txt" \
-udemo:demo -vk
  1. viewer role 👍
curl -XMOVE "https://localhost:9200/remote.php/dav/spaces/<file-id>" \             
-H"Destination: https://localhost:9200/remote.php/dav/spaces/<demo-personal-space-id>/file.txt" \
-udemo:demo -vk

Expected behavior

< HTTP/1.1 403 Forbidden

<?xml version="1.0" encoding="UTF-8"?>
<d:error
	xmlns:d="DAV"
	xmlns:s="http://sabredav.org/ns">
	<s:exception>Sabre\DAV\Exception\Forbidden</s:exception>
	<s:message>move: error: permission denied: %file-id-here%</s:message>
</d:error>

Actual behavior

< HTTP/1.1 502 Bad Gateway
<
<?xml version="1.0" encoding="UTF-8"?>
<d:error
	xmlns:d="DAV"
	xmlns:s="http://sabredav.org/ns">
	<s:exception></s:exception>
	<s:message>move:error: not supported: cannot move across spaces</s:message>
</d:error>
@saw-jan
Copy link
Member Author

saw-jan commented Jan 10, 2024

As per #8063 (comment), #8063 (comment) and #4087 (comment), the 502 statuscode is the correct code that server should respond. So closing this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants