fix: require delete permission for WebDAV overwrite
This commit is contained in:
@@ -1372,9 +1372,9 @@ func (f *webdavAuthFS) Create(ctx context.Context, name string, body io.ReadClos
|
|||||||
return nil, false, err
|
return nil, false, err
|
||||||
}
|
}
|
||||||
// CHFS permits PUT to overwrite an existing file only when the target
|
// CHFS permits PUT to overwrite an existing file only when the target
|
||||||
// itself is writable. A writable parent alone is enough for creation.
|
// itself is deletable. A writable parent alone is enough for creation.
|
||||||
if _, err := f.inner.Stat(ctx, name); err == nil {
|
if _, err := f.inner.Stat(ctx, name); err == nil {
|
||||||
if err := f.allow(name, auth.Write); err != nil {
|
if err := f.allow(name, auth.Delete); err != nil {
|
||||||
return nil, false, err
|
return nil, false, err
|
||||||
}
|
}
|
||||||
} else if !os.IsNotExist(err) {
|
} else if !os.IsNotExist(err) {
|
||||||
|
|||||||
Reference in New Issue
Block a user