Consider new DAV endpoint for public shares

[LukasReschke]

Stuff like http://b378zUCKQ3G9vn4:dummypassword@localhost/oc/public.php/webdav is not going to work in many browsers.

This prevents us to use WebDAV for some parts of ownCloud. For example the public view as can be seen at owncloud/files_videoplayer#41 (comment)

My idea would here to have something like public.php/share/$SHAREID/ so that no Basic Auth is required anymore. (password can still be provided but general authentication happens via session there)

[LukasReschke]

cc @karlitschek @DeepDiver1975 @icewind1991 Thoughts?

[michaelstingl]

@LukasReschke Thanks!

[MorrisJobke]

Maybe fixed by #24354

[LukasReschke]

I believe that this will still not solve the problem completely as it will still exist for password protected files. We can't rely on the system sending cookies 🙈

[felixboehm]

@michaelstingl Next steps? If this is green, then please provide a proper Milestone

[michaelstingl]

For video in Safari, it has been solved with #24750 .

[PVince81]

The Webdav endpoint "public.php/webdav" is already used for public links in the web UI and seems to work fine so far even with link passwords. Maybe browsers are modern enough now ?

A few operations like file download is still going back to the ajax endpoint currently because opening the link in a separate window caused trouble: #22297

[PVince81]

In general we still need to provide a "new DAV" endpoint for public links to be able to support web UI chunking, so let's keep this ticket open to discuss how to achieve this.

Maybe we should have a similar tree like "remote.php/dav/*" but in public:
"public.php/dav".

So we could have: "public.php/dav/share-links/$tokenId/path/to/file.txt". Would still require some kind of basic auth and cookies...
For chunked upload: "public.php/dav/uploads/..." then MOVE final file to the above location.

Or we make "remote.php" support different auths (even no auth) on specific subpaths so we don't need "public.php" any more... More risky though as we need to make sure the Sabre auth plugins properly apply to DAV subpaths. Current public.php has its own Sabre server.

For now I rather tend to the "public.php/dav" solution.

@DeepDiver1975

[PVince81]

WIP PR here: #29369