Merge pull request #13362 from nextcloud/backport/13354/master

[master] check anonymous OPTIONS requests file in root (not in subdir)

Author: rullzer

apps/dav/lib/Connector/Sabre/AnonymousOptionsPlugin.php

@@ -45,12 +45,19 @@ public function initialize(\Sabre\DAV\Server $server) {
 		$this->server->on('beforeMethod', [$this, 'handleAnonymousOptions'], 9);
 	}
 
+	/**
+	 * @return bool
+	 */
+	public function isRequestInRoot($path) {
+		return $path === '' || (is_string($path) && strpos($path, '/') === FALSE);
+	}
+
 	/**
 	 * @throws \Sabre\DAV\Exception\Forbidden
 	 * @return bool
 	 */
 	public function handleAnonymousOptions(RequestInterface $request, ResponseInterface $response) {
-		if ($request->getHeader('Authorization') === null && $request->getMethod() === 'OPTIONS') {
+		if ($request->getHeader('Authorization') === null && $request->getMethod() === 'OPTIONS' && $this->isRequestInRoot($request->getPath())) {
 			/** @var CorePlugin $corePlugin */
 			$corePlugin = $this->server->getPlugin('core');
 			// setup a fake tree for anonymous access

apps/dav/tests/unit/DAV/AnonymousOptionsTest.php

@@ -56,6 +56,12 @@ public function testAnonymousOptionsNonRoot() {
 
 		$this->assertEquals(200, $response->getStatus());
 	}
+
+	public function testAnonymousOptionsNonRootSubDir() {
+		$response = $this->sendRequest('OPTIONS', 'foo/bar');
+
+		$this->assertEquals(401, $response->getStatus());
+	}
 }
 
 class SapiMock extends Sapi {