Henrique Dias 3ded167a52 fix: authorize every path an operation touches ...

Recursive COPY, MOVE, DELETE and PROPFIND were checked only against the
requested path, reaching descendants their rules deny. A broad rule shadowed
a narrower one naming a collection. LOCK was allowed on any permission, so a
read-only user could create files and block writers. Rules compared case
where the backing file system does not.

2026-09-04 14:32:32 +02:00

..

casefold.go

fix: authorize every path an operation touches

2026-09-04 14:32:32 +02:00

config_test.go

feat: support CORS Private Network Access (#350)

2026-08-28 15:27:04 +02:00

config.go

feat: support CORS Private Network Access (#350)

2026-08-28 15:27:04 +02:00

files.go

fix(deps): update all dependencies

2025-06-20 07:56:09 +02:00

handler_test.go

fix: authorize every path an operation touches

2026-09-04 14:32:32 +02:00

handler.go

fix: authorize every path an operation touches

2026-09-04 14:32:32 +02:00

locksystem_test.go

fix: use slash-separated lock paths on Windows (#344)

2026-07-25 07:15:27 +02:00

locksystem.go

fix: use slash-separated lock paths on Windows (#344)

2026-07-25 07:15:27 +02:00

multidir_test.go

feat: add multi directories support (#335)

2026-07-12 09:51:10 +02:00

multidir.go

feat: add multi directories support (#335)

2026-07-12 09:51:10 +02:00

partial_update.go

fix: authorize every path an operation touches

2026-09-04 14:32:32 +02:00

permissions_fs.go

fix: authorize every path an operation touches

2026-09-04 14:32:32 +02:00

permissions_test.go

fix: authorize every path an operation touches

2026-09-04 14:32:32 +02:00

permissions.go

fix: authorize every path an operation touches

2026-09-04 14:32:32 +02:00

request.go

Merge commit from fork

2026-08-05 10:18:13 +02:00

user.go

fix: environment parsing for username

2024-10-20 09:09:05 +02:00