[stable-3.0] Disabled user can still access their files

[SwikritiT]

Describe the bug

Disabled user can still access their files.

Note this only exists in stable-3.0 branch

Steps to reproduce

Steps to reproduce the behavior:

1. Create user Alice

curl -u admin:admin -X POST https://localhost:9200/graph/v1.0/users -H "Content-Type: application/json" -d '{"onPremisesSamAccountName":"Alice","passwordProfile":{"password":"123456"},"displayName":"Alice Hansen","mail":"[email protected]","accountEnabled":true}' -vk

2. As user Alice upload a file with some content

 curl -u Alice:123456 -X PUT https://localhost:9200/remote.php/webdav/textfile0.txt -d "hello world" -vk

3. Disable user Alice

curl -u admin:admin -X PATCH https://localhost:9200/graph/v1.0/users/<user-id-of-alice>-H "Content-Type: application/json" -d '{"accountEnabled":false}' -vk

4. Download the file as user Alice

curl -u Alice:123456 -X GET https://localhost:9200/remote.php/webdav/textfile0.txt -vk  

Expected behavior

The request should fail with 401. (this is the behaviour in master)

Actual behavior

the request is successful with 200. The disabled user can create files as well.

Setup

Branch = stable-3.0
commit id = 7c20b18

Additional context

Add any other context about the problem here.

[SwikritiT]

I've created this issue because some tests are failing in the stable branch because of this and the test pass in the master.
If this is something that we don't want to fix for the stable branch then I can close this issue and skip the tests for the stable branch.

cc @micbar

[rhafer]

Backporting this would be the fix I think: #6516

Note: This issue only affects basic auth, which is disabled by default.

[SwikritiT]

Backporting this would be the fix I think: #6516

Note: This issue only affects basic auth, which is disabled by default.

If this only affects the basic auth should I just skip the tests in the stable branch? or would it be okay to backport the fix to stable as well? I can skip the test if the bug is not that big of an issue because the tests do pass in master.

[SwikritiT]

since we already release ocis-4.0 this issue is no longer relevant so closing this