diff --git a/changelog/unreleased/ocdav-move-body.md b/changelog/unreleased/ocdav-move-body.md new file mode 100644 index 0000000000..bc11910a25 --- /dev/null +++ b/changelog/unreleased/ocdav-move-body.md @@ -0,0 +1,6 @@ +Enhancement: Explicitly return on ocdav move requests with body + +Added a check if a ocdav move request contains a body. If it does a 415 415 (Unsupported Media Type) will be returned. + +https://github.com/owncloud/ocis/issues/3882 +https://github.com/cs3org/reva/pull/2974 diff --git a/internal/http/services/owncloud/ocdav/move.go b/internal/http/services/owncloud/ocdav/move.go index 4c9c56ed7c..ca513c6af5 100644 --- a/internal/http/services/owncloud/ocdav/move.go +++ b/internal/http/services/owncloud/ocdav/move.go @@ -41,6 +41,11 @@ func (s *svc) handlePathMove(w http.ResponseWriter, r *http.Request, ns string) ctx, span := rtrace.Provider.Tracer(tracerName).Start(r.Context(), "move") defer span.End() + if r.Body != http.NoBody { + w.WriteHeader(http.StatusUnsupportedMediaType) + return + } + srcPath := path.Join(ns, r.URL.Path) dh := r.Header.Get(net.HeaderDestination) baseURI := r.Context().Value(net.CtxKeyBaseURI).(string) @@ -95,6 +100,11 @@ func (s *svc) handleSpacesMove(w http.ResponseWriter, r *http.Request, srcSpaceI ctx, span := rtrace.Provider.Tracer(tracerName).Start(r.Context(), "spaces_move") defer span.End() + if r.Body != http.NoBody { + w.WriteHeader(http.StatusUnsupportedMediaType) + return + } + dh := r.Header.Get(net.HeaderDestination) baseURI := r.Context().Value(net.CtxKeyBaseURI).(string) dst, err := net.ParseDestination(baseURI, dh)