webdav

archive/webdav

Fork 0

mirror of https://github.com/hacdias/webdav.git synced 2026-09-22 03:20:41 +08:00

Commit Graph

Author	SHA1	Message	Date
Henrique Dias	04c863aefc	test: compare flipCase results with OS-native separators The expectations were written with forward slashes, but flipCase builds a path to stat and so separates it the way the running system does.	2026-09-04 14:36:46 +02:00
Henrique Dias	3ded167a52	fix: authorize every path an operation touches Recursive COPY, MOVE, DELETE and PROPFIND were checked only against the requested path, reaching descendants their rules deny. A broad rule shadowed a narrower one naming a collection. LOCK was allowed on any permission, so a read-only user could create files and block writers. Rules compared case where the backing file system does not.	2026-09-04 14:32:32 +02:00

Author

SHA1

Message

Date

Henrique Dias

04c863aefc

test: compare flipCase results with OS-native separators

The expectations were written with forward slashes, but flipCase builds a
path to stat and so separates it the way the running system does.

2026-09-04 14:36:46 +02:00

Henrique Dias

3ded167a52

fix: authorize every path an operation touches

Recursive COPY, MOVE, DELETE and PROPFIND were checked only against the
requested path, reaching descendants their rules deny. A broad rule shadowed
a narrower one naming a collection. LOCK was allowed on any permission, so a
read-only user could create files and block writers. Rules compared case
where the backing file system does not.

2026-09-04 14:32:32 +02:00