fix: additive permissions

2026-09-22 03:20:41 +08:00 · 2025-10-17 17:10:24 +02:00
19 changed files with 103 additions and 176 deletions
@@ -12,10 +12,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - uses: actions/setup-go@v6
        with:
-          go-version: "1.26.x"
+          go-version: "1.25.x"
      - run: go build .
        env:
          CGO_ENABLED: '0'
@@ -18,22 +18,22 @@ jobs:
      id-token: write
    steps:
      - name: Check out the repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USERNAME }}
          password: ${{ secrets.DOCKER_PASSWORD }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -41,7 +41,7 @@ jobs:

      - name: Extract metadata (tags, labels) for Docker
        id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v5
        with:
          images: |
            hacdias/webdav
@@ -55,7 +55,7 @@ jobs:

      - name: Build and push Docker image
        id: push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v6
        with:
          context: .
          file: ./Dockerfile
@@ -12,10 +12,10 @@ jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - uses: actions/setup-go@v6
        with:
-          go-version: "1.26.x"
-      - uses: golangci/golangci-lint-action@v9
+          go-version: "1.25.x"
+      - uses: golangci/golangci-lint-action@v8
        with:
          version: "latest"
@@ -12,13 +12,11 @@ jobs:
  goreleaser:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: actions/setup-go@v6
-        with:
-          go-version: "1.26.x"
-      - uses: goreleaser/goreleaser-action@v7
+      - uses: goreleaser/goreleaser-action@v6
        with:
          distribution: goreleaser
          version: '~> v2'
@@ -13,9 +13,9 @@ jobs:
    name: test
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v5
      - uses: actions/setup-go@v6
        with:
-          go-version: "1.26.x"
+          go-version: "1.25.x"
      - name: Run test with coverage
        run: go test -race -coverprofile=coverage.txt -covermode=atomic ./...
@@ -1,2 +1,2 @@
 dist/
-webdav
+webdav
@@ -38,20 +38,16 @@ builds:
      - goos: openbsd
        goarch: arm
        goarm: 6
-      # Broken as of Go 1.24, deprecated as of Go 1.26
      - goos: freebsd
        goarch: arm
-      - goos: windows
-        goarch: arm
+        goarm: 6

 archives:
  - name_template: "{{.Os}}-{{.Arch}}{{if .Arm}}v{{.Arm}}{{end}}-{{ .ProjectName }}"
-    formats:
-      - tar.gz
+    format: tar.gz
    format_overrides:
      - goos: windows
-        formats:
-          - zip
+        format: zip

 release:
  github:
@@ -1,7 +1,9 @@
-FROM golang:1.26-alpine3.22 AS build
+FROM golang:1.25-alpine3.22 AS build

 ARG VERSION="untracked"

+RUN apk --update add ca-certificates
+
 WORKDIR /webdav/

 COPY ./go.mod ./
@@ -13,6 +15,7 @@ RUN go build -o main -trimpath -ldflags="-s -w -X 'github.com/hacdias/webdav/v5/

 FROM scratch

+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build /webdav/main /bin/webdav

 EXPOSE 6065
@@ -38,23 +38,26 @@ docker pull hacdias/webdav:latest

 For usage information regarding the CLI, run `webdav --help`.

-### Container
+### Docker

-To run the container, you can refer to the `compose.yml` file which provides a minimal setup. Additionally, you also need to create a configuration file, as [explained below](#configuration).
+To use with Docker, you need to provide a configuration file and mount the data directories. For example, let's take the following configuration file that simply sets the port to `6060` and the directory to `/data`.

-The equivalent Docker command to the aforementioned compose file would be as follows:
+```yaml
+port: 6060
+directory: /data
+```
+
+You can now run with the following Docker command, where you mount the configuration file inside the container, and the data directory too, as well as forwarding the port 6060. You will need to change this to match your own configuration.

 ```bash
 docker run \
-  -p 6065:6065 \
-  -v ./config.yml:/config.yml:ro \
-  -v ./data:/data \
+  -p 6060:6060 \
+  -v $(pwd)/config.yml:/config.yml:ro \
+  -v $(pwd)/data:/data \
  ghcr.io/hacdias/webdav -c /config.yml
 ```

-If you are using [fail2ban](#fail2ban-setup), it would be helpful to add the parameters listed below. They will assist in analyzing 
-the log.
-
+If you are using [fail2ban](#fail2ban-setup), it would be helpful to add the parameters listed below. They will assist in analyzing the log.
 ```bash
 --log-driver journald \
 --name webdav \
@@ -62,8 +65,7 @@ the log.

 ## Configuration

-The configuration can be provided as a YAML, JSON or TOML file. Below is an example of a YAML configuration file with 
-all the options available, as well as what they mean.
+The configuration can be provided as a YAML, JSON or TOML file. Below is an example of a YAML configuration file with all the options available, as well as what they mean.

 ```yaml
 address: 0.0.0.0
@@ -90,9 +92,8 @@ behindProxy: false

 # The directory that will be able to be accessed by the users when connecting.
 # This directory will be used by users unless they have their own 'directory' defined.
-# By default it points to the working directory. In the case of the compose file above,
-# that is /data.
-directory: /data
+# Default is '.' (current directory).
+directory: .

 # The default permissions for users. This is a case insensitive option. Possible
 # permissions: C (Create), R (Read), U (Update), D (Delete). You can combine multiple
@@ -123,64 +124,48 @@ log:
  colors: true
  # Logging outputs. You can have more than one output. Default is only 'stderr'.
  outputs:
-    - stderr
+  - stderr

 # CORS configuration
 cors:
  # Whether or not CORS configuration should be applied. Default is 'false'.
  enabled: true
  credentials: true
-  # The following are the default CORS settings when it is enabled.
-  allowed_hosts:
-    - *
  allowed_headers:
-    - Authorization
-    - Content-Type
    - Depth
-    - Destination
-    - If
-    - Lock-Token
-    - Overwrite
-    - TimeOut
-    - Translate
+  allowed_hosts:
+    - http://localhost:8080
  allowed_methods:
-    - COPY
-    - DELETE
    - GET
-    - HEAD
-    - LOCK
-    - UNLOCK
-    - MKCOL
-    - MOVE
-    - OPTIONS
-    - POST
-    - PROPFIND
-    - PROPPATCH
-    - PUT
-  exposed_headers: []
+  exposed_headers:
+    - Content-Length
+    - Content-Range

-# You define here the list of users.
-# Basic authentication is automatically be configured when users are detected 
-# below, else there will be no authentication.
-# Customize to your needs and don't forget to comment out the users you don't need.
+# The list of users. If the list is empty, then there will be no authentication.
+# Otherwise, basic authentication will automatically be configured.
+#
+# If you're delegating the authentication to a different service, you can proxy
+# the username using basic authentication, and then disable webdav's password
+# check using the option:
+#
+# noPassword: true
 users:
  # Example 'admin' user with plaintext password.
  - username: admin
    password: admin
-
  # Example 'john' user with bcrypt encrypted password, with custom directory.
-  # Tip: you can generate a bcrypt-encrypted password by using the 'webdav bcrypt'
-  # command lint utility, or htpasswd on Linux.
+  # You can generate a bcrypt-encrypted password by using the 'webdav bcrypt'
+  # command lint utility.
  - username: john
    password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
-    directory: /data/john
+    directory: /another/path
  # Example user whose details will be picked up from the environment.
  - username: "{env}ENV_USERNAME"
    password: "{env}ENV_PASSWORD"
-  # Example user with advanced control over his permissions
  - username: basic
    password: basic
-    permissions: CRUD # Override default permissions.
+    # Override default permissions.
+    permissions: CRUD
    rules:
      # With this rule, the user CANNOT access {user directory}/some/files.
      - path: /some/file
@@ -193,16 +178,6 @@ users:
      # It uses a regular expression.
      - regex: "^.+.js$"
        permissions: RU
-  # Example user for android SeedVault backuping
-  - username: android
-    password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
-    directory: /data/android
-    permissions: CRUD
-
-# If you're delegating the authentication to a different service, you can proxy
-# the username using basic authentication, and then disable webdav's password
-# check using the option:
-# noPassword: true
 ```

 ### CORS
@@ -250,8 +225,7 @@ example.com {
    @hasDest header_regexp dest ^https?://[^/]+(.*)$
    header @hasDest Destination {re.dest.1}

-    # if running on the same network in docker you can just point to the service name e.g. webdav:6065
-    reverse_proxy 127.0.0.1:6065 {
+    reverse_proxy 127.0.0.1:6065 { # if running on the same network in docker you can just point to the service name e.g. webdav:6065
        header_up X-Real-IP {remote_host}
        header_up REMOTE-HOST {remote_host}
    }
@@ -1,7 +1,6 @@
 package cmd

 import (
-	"context"
 	"errors"
 	"fmt"
 	"net"
@@ -81,8 +80,6 @@ set WD_CERT.`,
 			return err
 		}

-		server := &http.Server{Handler: handler}
-
 		// Trap exiting signals
 		quit := make(chan os.Signal, 1)

@@ -91,9 +88,9 @@ set WD_CERT.`,

 			var err error
 			if cfg.TLS {
-				err = server.ServeTLS(listener, cfg.Cert, cfg.Key)
+				err = http.ServeTLS(listener, handler, cfg.Cert, cfg.Key)
 			} else {
-				err = server.Serve(listener)
+				err = http.Serve(listener, handler)
 			}

 			if err != nil && !errors.Is(err, http.ErrServerClosed) {
@@ -107,7 +104,7 @@ set WD_CERT.`,
 		signal := <-quit

 		zap.L().Info("caught signal, shutting down", zap.Stringer("signal", signal))
-		_ = server.Shutdown(context.Background())
+		_ = listener.Close()

 		return nil
 	},
@@ -1,14 +0,0 @@
-name: webdav
-
-services:
-  app:
-    container_name: webdav
-    image: 'webdav:test'
-    ports:
-     - '6065:6065'
-    security_opt:
-      - label=type:container_runtime_t
-    restart: always
-    volumes:
-      - ./data:/data
-      - ./config.yml:/config.yml:ro
@@ -3,18 +3,17 @@ module github.com/hacdias/webdav/v5
 go 1.25.0

 require (
-	github.com/coreos/go-systemd/v22 v22.7.0
-	github.com/go-viper/mapstructure/v2 v2.5.0
+	github.com/coreos/go-systemd/v22 v22.6.0
+	github.com/go-viper/mapstructure/v2 v2.4.0
 	github.com/rs/cors v1.11.1
-	github.com/spf13/cobra v1.10.2
+	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.10
 	github.com/spf13/viper v1.21.0
 	github.com/stretchr/testify v1.11.1
-	github.com/studio-b12/gowebdav v0.12.0
-	go.uber.org/zap v1.27.1
-	golang.org/x/crypto v0.50.0
-	golang.org/x/crypto/x509roots/fallback v0.0.0-20260413170323-a8e9237a216b
-	golang.org/x/net v0.53.0
+	github.com/studio-b12/gowebdav v0.11.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/crypto v0.43.0
+	golang.org/x/net v0.46.0
 )

 require (
@@ -30,7 +29,7 @@ require (
 	github.com/subosito/gotenv v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -1,5 +1,5 @@
-github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA=
-github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w=
+github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=
+github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -7,8 +7,8 @@ github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHk
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
-github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
@@ -34,8 +34,8 @@ github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
 github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
-github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
-github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s=
+github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
@@ -43,28 +43,26 @@ github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU=
 github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/studio-b12/gowebdav v0.12.0 h1:kFRtQECt8jmVAvA6RHBz3geXUGJHUZA6/IKpOVUs5kM=
-github.com/studio-b12/gowebdav v0.12.0/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE=
+github.com/studio-b12/gowebdav v0.11.0 h1:qbQzq4USxY28ZYsGJUfO5jR+xkFtcnwWgitp4Zp1irU=
+github.com/studio-b12/gowebdav v0.11.0/go.mod h1:bHA7t77X/QFExdeAnDzK6vKM34kEZAcE1OX4MfiwjkE=
 github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8=
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
-go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
-golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20260413170323-a8e9237a216b h1:ZG2SxTKsx1w3pUpOMD9dliRYnhWC5R5jmL6UDPCbYj4=
-golang.org/x/crypto/x509roots/fallback v0.0.0-20260413170323-a8e9237a216b/go.mod h1:+UoQFNBq2p2wO+Q6ddVtYc25GZ6VNdOMyyrd4nrqrKs=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
+golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -86,9 +86,9 @@ func ParseConfig(filename string, flags *pflag.FlagSet) (*Config, error) {
 	v.SetDefault("Log.Format", "console")
 	v.SetDefault("Log.Outputs", []string{"stderr"})
 	v.SetDefault("Log.Colors", true)
+	v.SetDefault("CORS.Allowed_Headers", []string{"*"})
 	v.SetDefault("CORS.Allowed_Hosts", []string{"*"})
-	v.SetDefault("CORS.Allowed_Headers", []string{"Authorization", "Content-Type", "Depth", "Destination", "If", "Lock-Token", "Overwrite"})
-	v.SetDefault("CORS.Allowed_Methods", []string{"COPY", "DELETE", "GET", "HEAD", "LOCK", "MKCOL", "MOVE", "OPTIONS", "POST", "PROPFIND", "PROPPATCH", "PUT", "UNLOCK"})
+	v.SetDefault("CORS.Allowed_Methods", []string{"*"})

 	// Read and unmarshal configuration
 	err := v.ReadInConfig()
@@ -51,9 +51,9 @@ func TestConfigDefaults(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, dir, cfg.Directory)

+	require.EqualValues(t, []string{"*"}, cfg.CORS.AllowedHeaders)
 	require.EqualValues(t, []string{"*"}, cfg.CORS.AllowedHosts)
-	require.EqualValues(t, []string{"Authorization", "Content-Type", "Depth", "Destination", "If", "Lock-Token", "Overwrite"}, cfg.CORS.AllowedHeaders)
-	require.EqualValues(t, []string{"COPY", "DELETE", "GET", "HEAD", "LOCK", "MKCOL", "MOVE", "OPTIONS", "POST", "PROPFIND", "PROPPATCH", "PUT", "UNLOCK"}, cfg.CORS.AllowedMethods)
+	require.EqualValues(t, []string{"*"}, cfg.CORS.AllowedMethods)
 }

 func TestConfigCascade(t *testing.T) {
@@ -25,11 +25,6 @@ type Handler struct {
 func NewHandler(c *Config) (http.Handler, error) {
 	ls := webdav.NewMemLS()

-	logFunc := func(r *http.Request, err error) {
-		lZap := getRequestLogger(r, c.BehindProxy)
-		lZap.Debug("handle webdav request", zap.String("method", r.Method), zap.String("path", r.URL.Path), zap.Error(err))
-	}
-
 	h := &Handler{
 		noPassword:  c.NoPassword,
 		behindProxy: c.BehindProxy,
@@ -47,7 +42,6 @@ func NewHandler(c *Config) (http.Handler, error) {
 					LockSystem: ls,
 					directory:  c.Directory,
 				},
-				Logger: logFunc,
 			},
 		},
 		users: map[string]*handlerUser{},
@@ -66,7 +60,6 @@ func NewHandler(c *Config) (http.Handler, error) {
 					LockSystem: ls,
 					directory:  u.Directory,
 				},
-				Logger: logFunc,
 			},
 		}
 	}
@@ -97,12 +90,13 @@ func NewHandler(c *Config) (http.Handler, error) {
 func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	user := h.user

-	lZap := getRequestLogger(r, h.behindProxy)
-
 	// Authentication
 	if len(h.users) > 0 {
 		w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)

+		// Retrieve the real client IP address using the updated helper function
+		remoteAddr := getRealRemoteIP(r, h.behindProxy)
+
 		// Gets the correct user for this request.
 		username, password, ok := r.BasicAuth()
 		if !ok {
@@ -113,26 +107,26 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		user, ok = h.users[username]
 		if !ok {
 			// Log invalid username
-			lZap.Info("invalid username", zap.String("username", username))
+			zap.L().Info("invalid username", zap.String("username", username), zap.String("remote_address", remoteAddr))
 			http.Error(w, "Not authorized", http.StatusUnauthorized)
 			return
 		}

 		if !h.noPassword && !user.checkPassword(password) {
 			// Log invalid password
-			lZap.Info("invalid password", zap.String("username", username))
+			zap.L().Info("invalid password", zap.String("username", username), zap.String("remote_address", remoteAddr))
 			http.Error(w, "Not authorized", http.StatusUnauthorized)
 			return
 		}

 		// Log successful authorization
-		lZap.Info("user authorized", zap.String("username", username))
+		zap.L().Info("user authorized", zap.String("username", username), zap.String("remote_address", remoteAddr))
 	}

 	// Convert the HTTP request into an internal request type
 	req, err := newRequest(r, h.user.Prefix)
 	if err != nil {
-		lZap.Info("invalid request path or destination", zap.Error(err))
+		zap.L().Info("invalid request path or destination", zap.Error(err))
 		http.Error(w, "Invalid request path or destination", http.StatusBadRequest)
 		return
 	}
@@ -143,7 +137,7 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return !os.IsNotExist(err)
 	})

-	lZap.Debug("allowed & method & path", zap.Bool("allowed", allowed), zap.String("method", r.Method), zap.String("path", r.URL.Path))
+	zap.L().Debug("allowed & method & path", zap.Bool("allowed", allowed), zap.String("method", r.Method), zap.String("path", r.URL.Path))

 	if !allowed {
 		w.WriteHeader(http.StatusForbidden)
@@ -180,14 +174,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	user.ServeHTTP(w, r)
 }

-// getRequestLogger creates a zap.Logger using the request remote ip.
-func getRequestLogger(r *http.Request, behindProxy bool) *zap.Logger {
-	// Retrieve the real client IP address using the updated helper function
-	remoteAddr := getRealRemoteIP(r, behindProxy)
-
-	return zap.L().With(zap.String("remote_address", remoteAddr))
-}
-
 // getRealRemoteIP retrieves the client's actual IP address, considering reverse proxies.
 func getRealRemoteIP(r *http.Request, behindProxy bool) string {
 	if behindProxy {
@@ -290,12 +290,6 @@ users:

 	err = client.Write("/c/b.txt", []byte("new"), 0666)
 	require.ErrorContains(t, err, "403")
-
-	err = client.MkdirAll("/d/foo/bar", 0666)
-	require.NoError(t, err)
-
-	err = client.Write("/d/foo/bar/test.txt", []byte("test"), 0666)
-	require.NoError(t, err)
 }

 func TestServerRulesAdditive(t *testing.T) {
@@ -2,8 +2,6 @@ package main

 import (
 	"github.com/hacdias/webdav/v5/cmd"
-
-	_ "golang.org/x/crypto/x509roots/fallback"
 )

 func main() {
@@ -4,12 +4,10 @@
    "config:recommended",
    "group:allNonMajor",
    "group:allDigest",
-    ":disableDependencyDashboard",
-    ":semanticCommitTypeAll(chore)"
+    ":disableDependencyDashboard"
  ],
  "postUpdateOptions": [
    "gomodUpdateImportPaths",
    "gomodTidy"
-  ],
-  "schedule": "* * * * 0,6"
+  ]
 }