security: harden WebDAV overwrite and multi-root routing

chfs-ng/internal/storage/multipath.go

@@ -3,6 +3,7 @@ package storage
 import (
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -23,15 +24,9 @@ func NewMulti(paths []string) Multi {
 		if name == "." || name == string(filepath.Separator) || name == "" {
 			name = "root"
 		}
-		duplicate := false
-		for _, existing := range m.Names {
-			if existing == name {
-				duplicate = true
-				break
-			}
-		}
-		if duplicate {
-			continue
+		base := name
+		for i := 2; containsString(m.Names, name); i++ {
+			name = base + "-" + strconv.Itoa(i)
 		}
 		m.Roots = append(m.Roots, Local{Root: abs})
 		m.Names = append(m.Names, name)
@@ -39,6 +34,15 @@ func NewMulti(paths []string) Multi {
 	return m
 }
 
+func containsString(items []string, want string) bool {
+	for _, item := range items {
+		if item == want {
+			return true
+		}
+	}
+	return false
+}
+
 func (m Multi) isVirtualRoot(p string) bool { return strings.Trim(p, "/") == "" }
 
 func (m Multi) FindRoot(p string) (string, string, bool) {