WebDAV: Endpoints must be fully disabled in public mode

[lastzero]

As a user running their instance in public mode, I expect WebDAV to be completely disabled as it is not possible to manage access in the web UI, it does not work without a password, and it is not possible to use it without a password to prevent abuse.

Although and because it is not possible to use WebDAV in public mode (a non-empty password is required), the endpoint must be completely disabled to avoid running unused services and to clearly signal that support is neither intended nor desirable.

• the User Guide clearly states that WebDAV is automatically disabled when running in read-only or public mode
• a support request indicated that endpoints were only fully disabled in read-only and/or demo mode
• these are often enabled in combination with public mode, which is probably why it was not noticed earlier

This issue has nothing to do with the ability to explicitly disable WebDAV in the configuration, that was possible before and still is.

[david1155]

Hello,
I'm using external two-factor auth (Authelia) for the frontend. Therefore, I set PHOTOPRISM_PUBLIC=true.
I also use several devices with PhotoSync to automatically upload media via WebDav (with password auth passthrough frontend auth). Please advise how is it possible to continue using WebDAV upload functionality without using built-in web auth for the whole PhotoPrism?
Maybe it's worth implementing something like this to allow such use-case:

PHOTOPRISM_DISABLE_WEBDAV=false
PHOTOPRISM_PUBLIC=true

Thank you very much in advance.

[lastzero]

You could run a custom file server. How did it work before? Were you able to use WebDAV without password?

[david1155]

I used the following nginx frontend config:

location /import {
  auth_basic    off;
  dav_methods                 PUT DELETE MKCOL;# COPY MOVE;
  create_full_put_path        on;
  dav_access                  user:rw  group:rw  all:r;
  dav_ext_methods             PROPFIND OPTIONS;
  proxy_pass http://127.0.0.1:2342;

PhotoSync has a built-in PhotoPrism plugin for authenticating via WebDAV. In fact, I used a standard admin account and password to authenticate. It was more convenient than a custom file server because PhotoPrism starts importing instantly after upload.

[david1155]

It was configured long time ago per documentation

[bschnei]

It was also useful for me to have the front end be "public" but the WebDAV endpoint still require authorization for similar reasons as @david1155. No disagreement that that behavior feels inconsistent with the definition of "public" so I'm supportive of the change for that reason, but it would also be great if the two things were separately configurable rather than all-or-nothing.