You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
For the incoming /dav/files/userID requests, we have different namespaces depending on whether the request is for the logged-in user's namespace or not. Since in the storage drivers, we specify the layout depending only on the logged in user, this works in the first condition. However, when a user wants to access another user's namespace when the storage provider depends on the logged in user's namespace, it fails.
For example, consider the following case. The owncloud fs uses a layout {{substr 0 1 .Id.OpaqueId}}/{{.Id.OpaqueId}} The user einstein sends a request /dav/files/marie, which should be allowed. However, based on the current way we apply the layout, there's no way in which this can be translated to /m/marie/
reva/internal/http/services/owncloud/ocdav/dav.go
Lines 59 to 66 in 5831dc0
For the incoming
/dav/files/userID
requests, we have different namespaces depending on whether the request is for the logged-in user's namespace or not. Since in the storage drivers, we specify the layout depending only on the logged in user, this works in the first condition. However, when a user wants to access another user's namespace when the storage provider depends on the logged in user's namespace, it fails.For example, consider the following case. The owncloud fs uses a layout
{{substr 0 1 .Id.OpaqueId}}/{{.Id.OpaqueId}}
The user einstein sends a request/dav/files/marie
, which should be allowed. However, based on the current way we apply the layout, there's no way in which this can be translated to/m/marie/
reva/internal/http/services/owncloud/ocdav/ocdav.go
Lines 195 to 197 in 5831dc0
It can only use the details of the user in context. This needs to be changed to handle such requests. @butonic @PVince81
The text was updated successfully, but these errors were encountered: