return early on ocdav move requests with body (#2974)

cs3org · Jun 15, 2022 · 1d12472 · 1d12472
1 parent 03c87b6
commit 1d12472
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/changelog/unreleased/ocdav-move-body.md b/changelog/unreleased/ocdav-move-body.md
@@ -0,0 +1,6 @@
+Enhancement: Explicitly return on ocdav move requests with body
+
+Added a check if a ocdav move request contains a body. If it does a 415 415 (Unsupported Media Type) will be returned.
+
+https://github.com/owncloud/ocis/issues/3882
+https://github.com/cs3org/reva/pull/2974
diff --git a/internal/http/services/owncloud/ocdav/move.go b/internal/http/services/owncloud/ocdav/move.go
@@ -41,6 +41,11 @@ func (s *svc) handlePathMove(w http.ResponseWriter, r *http.Request, ns string)
 	ctx, span := rtrace.Provider.Tracer(tracerName).Start(r.Context(), "move")
 	defer span.End()
 
+	if r.Body != http.NoBody {
+		w.WriteHeader(http.StatusUnsupportedMediaType)
+		return
+	}
+
 	srcPath := path.Join(ns, r.URL.Path)
 	dh := r.Header.Get(net.HeaderDestination)
 	baseURI := r.Context().Value(net.CtxKeyBaseURI).(string)
@@ -95,6 +100,11 @@ func (s *svc) handleSpacesMove(w http.ResponseWriter, r *http.Request, srcSpaceI
 	ctx, span := rtrace.Provider.Tracer(tracerName).Start(r.Context(), "spaces_move")
 	defer span.End()
 
+	if r.Body != http.NoBody {
+		w.WriteHeader(http.StatusUnsupportedMediaType)
+		return
+	}
+
 	dh := r.Header.Get(net.HeaderDestination)
 	baseURI := r.Context().Value(net.CtxKeyBaseURI).(string)
 	dst, err := net.ParseDestination(baseURI, dh)