upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-05-26 03:04:35 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 9

fix(dav): do not read intermediate uploads

Browse source 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
This commit is contained in:
Ferdinand Thiessen 2026-04-08 23:09:32 +02:00
parent 54252ca04b
commit 7adeca3c5a
No known key found for this signature in database
GPG key ID: 7E849AE05218500F
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
apps/dav/lib/Upload/ChunkingV2Plugin.php
View file

@ -30,6 +30,7 @@ use OCP\IConfig;
use OCP\Lock\ILockingProvider;
use Sabre\DAV\Exception\BadRequest;
use Sabre\DAV\Exception\InsufficientStorage;
use Sabre\DAV\Exception\MethodNotAllowed;
use Sabre\DAV\Exception\NotFound;
use Sabre\DAV\Exception\PreconditionFailed;
use Sabre\DAV\ICollection;
@ -68,14 +69,24 @@ class ChunkingV2Plugin extends ServerPlugin {
* @inheritdoc
*/
public function initialize(Server $server) {
$server->on('afterMethod:MKCOL', [$this, 'afterMkcol']);
$server->on('beforeMethod:GET', $this->beforeGet(...));
$server->on('beforeMethod:PUT', [$this, 'beforePut']);
$server->on('beforeMethod:DELETE', [$this, 'beforeDelete']);
$server->on('beforeMove', [$this, 'beforeMove'], 90);
$server->on('afterMethod:MKCOL', [$this, 'afterMkcol']);
$this->server = $server;
}
protected function beforeGet(RequestInterface $request) {
$sourceNode = $this->server->tree->getNodeForPath($request->getPath());
if (($sourceNode instanceof FutureFile) || ($sourceNode instanceof UploadFile)) {
throw new MethodNotAllowed('Reading intermediate uploads is not allowed');
}
return true;
}
/**
* @param string $path
* @param bool $createIfNotExists