fix(dav): honour the write hook veto on legacy chunked uploads [backport 10.16] - #41763
Merged
Merged
Conversation
…ort 10.16] The legacy WebDAV chunked upload path assembled the final file without respecting the pre-write hook result, so the filename blacklist that applies to ordinary uploads was not enforced for chunked uploads. The chunked assembly now aborts when a write hook vetoes the file, matching the non-chunked upload path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
DeepDiver1975
force-pushed
the
fix/chunked-upload-write-veto-10.16
branch
from
July 29, 2026 14:30
b5678f3 to
0a326f9
Compare
phil-davis
approved these changes
Jul 29, 2026
Merged
DeepDiver1975
added a commit
that referenced
this pull request
Jul 29, 2026
Bump version.php to 10.16.4 and materialize the changelog fragments for this release: - #41763 honour the write hook veto on legacy chunked WebDAV uploads - #41574 fix subadmin email change updating caller's address Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This was referenced Jul 29, 2026
feat(server): update 10.16.3 to 10.16.4 image from GitHub release tarball
owncloud-docker/server#676
Merged
DeepDiver1975
added a commit
that referenced
this pull request
Jul 29, 2026
Forward-port the released 10.16.4 changelog fragments from the 10.16 branch
so master reflects that 10.16.4 has shipped.
- add changelog/10.16.4_2026-07-29/{41574,41763}
- drop changelog/unreleased/41574, which has now been released
- regenerate CHANGELOG.md via calens
changelog/unreleased/41762 is intentionally kept: it is the 11.x-line entry
for the same chunked-upload fix that #41763 backported to 10.16.
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #41762 to
10.16.Summary
Make the legacy WebDAV chunked upload path honour the pre-write hook veto.
createFileChunked()inapps/dav/lib/Connector/Sabre/File.phpcalledemitPreHooks()but discarded its return value, then assembled the chunks intothe final file unconditionally. As a result the filename blacklist that applies
to ordinary uploads (enforced via the write hook) was not honoured for chunked
uploads — a name that is rejected on the normal
PUTpath could still bewritten through the chunked path.
The chunked assembly now captures the hook result and aborts — unlock the
target, clean up the part files, and throw
Forbidden— when a write hookvetoes the file, mirroring the existing non-chunked
put()path.Changes
apps/dav/lib/Connector/Sabre/File.php— honour theemitPreHooks()veto inthe chunked assembly path.
apps/dav/tests/unit/Connector/Sabre/FileTest.php— addtestChunkedPutToBlacklistedNameIsForbidden(), a regression test that pushesa blacklisted name via chunking and asserts it is rejected and never reaches
the storage backend.
Testing
storage) and passes with it.
apps/davSabre connector suite: 456 tests, 1698 assertions — green.php-cs-fixerreports no changes.