don't allow upload/creation of .part files

[schiessle]

we use the file extension .part for uploading large files. Therefore we ignore .part files and don't expose them in the web ui or to a webdav client.

Our sync client, correctly doesn't upload .part files. Also direct webdav uploads refuse to upload .part files. But it is possible to:

• upload .part files over the web interface
• create a new empty .part file
• rename a regular file to a .part file

This will result in files on the server which are no longer accessible by the user. All this operation should be blocked.

@nickvergessen maybe you want to have a look at it if you have some time? Thanks!

cc @PVince81

[italovalcy]

Hello everyone,

I and some guys from raul hacker club (raulhc.cc) were looking at some tasks to help owncloud and we found this task interesting. Is @PVince81 still working on this? Can we propose some patch to this issue?

Initially we tried to reproduce the problem, but when we uploaded some file through webdav we received a error message at the client side (I/O error on the server). From the server side, we found the following on apache logs:

PHP Fatal error: Call to a member function getEtag() on a non-object in /app/owncloud/lib/private/connector/sabre/file.php on line 153

Please let we know if we can help on this task.

Regards, Italo

[PVince81]

@italovalcy feel free to take over. Trouble is that I was stuck with unwanted side-effects. Here is the WIP PR #7514 (comment).

Alternatively if you're looking for simpler tasks to start with, check out issues with the "Junior Job" tag.

[PVince81]

This won't be fully fixable as long as OC 7 is supported due to federation, see #7514 (comment) for an explanation.

Moving to 9.0 to keep it in sight.

[PVince81]

Since OC 7 will still be around when OC 9 is out, moving to 9.1.

See #7514 (comment) for the explanation why.

[PVince81]

CC @cmonteroluque

[ghost]

thanks @PVince81

[IljaN]

@PVince81 #27269

[PVince81]

This fix is incomplete, part file upload is still possible with Webdav on v10.0.2.

On v10.0.3 another bug prevents it, but we need this fix this correctly.

Reopening.

[PVince81]

@IljaN please have a look

[PVince81]

also please add integration tests to make sure we can't:

• upload part files through Webdav
• rename or copy any file to ".part" with Webdav

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.