[Bug]: 405 Method Not Allowed returned for PROPFIND request with additional properties for non existing file

[dkocher]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• Nextcloud Server is running on 64bit capable CPU, PHP and OS.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

For PROPFIND requests that request attributes in namespace http://nextcloud.org/ns a 405 error is returned instead of expected 404 for non existent files.

Steps to reproduce

PROPFIND /bMZUnQuf HTTP/1.1
Depth: 0
Content-Type: text/xml; charset=utf-8
Content-Length: 344
Host: cloud.iterate.ch
Connection: Keep-Alive
Accept-Encoding: gzip,deflate

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><propfind xmlns="DAV:"><prop><creationdate/><displayname/><getcontentlength/><getcontenttype/><getetag/><getlastmodified/><lockdiscovery/><resourcetype/><nc:fileid xmlns:nc="http://nextcloud.org/ns"/><s:lastmodified_server xmlns:s="SAR:"/><s:lastmodified xmlns:s="SAR:"/></prop></propfind>

HTTP/1.1 405 Method Not Allowed
Server: nginx/1.20.0
Date: Thu, 13 Oct 2022 10:24:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-Vkk4eUljT1c0a0NJNVNpeW5iNU1qV2VtZHJZZ1RZbkFiR2dPWkxvbHJqND06SmNWWmM0ckJoU0hFM1d5R3R0by8zeXlTTi9JUEorWDJBUUJ0TC9GaStFOD0='; style-src 'self' 'unsafe-inline'; frame-src *; img-src * data: blob:; font-src 'self' data:; media-src *; connect-src *; object-src 'none'; base-uri 'self';
Set-Cookie: nc_username=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; secure; HttpOnly
Set-Cookie: nc_token=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; secure; HttpOnly
Set-Cookie: nc_session_id=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; secure; HttpOnly
Set-Cookie: nc_username=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly
Set-Cookie: nc_token=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly
Set-Cookie: nc_session_id=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly
Set-Cookie: oc7vsmzhpklo=c5unjcpoalac582uhsdsl60ige; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: cookie_test=test; expires=Thu, 13-Oct-2022 11:24:15 GMT; Max-Age=3600

Expected behavior

404 error response.

Installation method

Community Manual installation with Archive

Operating system

RHEL/CentOS

PHP engine version

PHP 7.3

Web server

Nginx

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

–

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No response

Additional info

No response

[szaimen]

Which nc version?

[dkocher]

Which nc version?

Running version 23.0.6.

[dkocher]

This cannot be reproduced with the actual /remote.php/webdav prefix where the DAV handler is enabled.

[vsajip]

I can certainly reproduce it with NC 27.0.0. Here are the request and response headers I see in my browser's developer pane:

PROPFIND /.well-known/caldav HTTP/2
Host: cloud.red-dove.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate, br
requesttoken: <redacted>
OCS-APIREQUEST: true
X-Requested-With: XMLHttpRequest
Origin: https://cloud.red-dove.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
TE: trailers

HTTP/2 405 Method Not Allowed
server: nginx
date: Thu, 13 Jul 2023 21:31:19 GMT
content-type: text/html; charset=iso-8859-1
content-length: 312
allow: GET,HEAD,POST,OPTIONS,TRACE
X-Firefox-Spdy: h2

As per the documentation, I used these rewrite rules with Apache (as NC is installed in a subfolder called nextcloud):

  RewriteRule ^\.well-known/carddav https://%{SERVER_NAME}/nextcloud/remote.php/dav [R=301,L]
  RewriteRule ^\.well-known/caldav https://%{SERVER_NAME}/nextcloud/remote.php/dav [R=301,L]