cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
1,662 Commits 2 Branches 0 Tags
7ffb7bf0ae2be8a5c8d8a500a3cf439fd7a8565b
Commit Graph

4 Commits

Author SHA1 Message Date
Edouard Vanbelle 7aea383588 feat(antienum): 403 when sub can read, 404 otherwise 
this is a UX improvement, always return a 404 not found when subject do not have any access on the resource
    but returns an explicit 403 forbidden is subject try a forbidden action on a resourse it can read

    regarding performance, the role is already in cache for the second call with read perm
 2026-07-16 22:09:45 +02:00
Edouard Vanbelle 5b996bb218 security(webdav+nc): antienum (404) rather returning a 500 with reason 2026-07-16 21:25:13 +02:00
Edouard Vanbelle f7deb7aaf4 fix(authz): invalidate role cache on change 2026-07-06 23:07:49 +02:00
Edouard Vanbelle 7e34045ff8 feat(drive): fix webdav back-compat 
add env variable `OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX`
    which is by default:
    `OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX="@drive"`

    so `/webdav/` -> points to user's personal drive (**backward compatibilit**y)
    `/web/dav/@drive/{uuid|drive name}/` points to the respective drive

    if admins want directly `/webdav/` pointing to list of drives they need to:
    `OXICLOUD_WEBDAV_DRIVE_LISTING_PREFIX=""`

    + ensure lock is per user (RFC 4918 §9.11)

    fix: #554
 2026-07-06 22:14:50 +02:00