From 7b4d4dcca8e027ea54aeefa69fb44efbd19ee148 Mon Sep 17 00:00:00 2001
From: Bastien Durel <bastien@durel.org>
Date: Fri, 4 Jan 2019 13:05:35 +0100
Subject: [PATCH] check anonymous OPTIONS requests file in root (not in subdir)

Signed-off-by: Bastien Durel <bastien@durel.org>
---
 apps/dav/lib/Connector/Sabre/AnonymousOptionsPlugin.php | 9 ++++++++-
 apps/dav/tests/unit/DAV/AnonymousOptionsTest.php        | 6 ++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/apps/dav/lib/Connector/Sabre/AnonymousOptionsPlugin.php b/apps/dav/lib/Connector/Sabre/AnonymousOptionsPlugin.php
index 390cb4a9c6..67c1a9a511 100644
--- a/apps/dav/lib/Connector/Sabre/AnonymousOptionsPlugin.php
+++ b/apps/dav/lib/Connector/Sabre/AnonymousOptionsPlugin.php
@@ -45,12 +45,19 @@ class AnonymousOptionsPlugin extends ServerPlugin {
 		$this->server->on('beforeMethod', [$this, 'handleAnonymousOptions'], 9);
 	}
 
+	/**
+	 * @return bool
+	 */
+	public function isRequestInRoot($path) {
+		return $path === '' || (is_string($path) && strpos($path, '/') === FALSE);
+	}
+
 	/**
 	 * @throws \Sabre\DAV\Exception\Forbidden
 	 * @return bool
 	 */
 	public function handleAnonymousOptions(RequestInterface $request, ResponseInterface $response) {
-		if ($request->getHeader('Authorization') === null && $request->getMethod() === 'OPTIONS') {
+		if ($request->getHeader('Authorization') === null && $request->getMethod() === 'OPTIONS' && $this->isRequestInRoot($request->getPath())) {
 			/** @var CorePlugin $corePlugin */
 			$corePlugin = $this->server->getPlugin('core');
 			// setup a fake tree for anonymous access
diff --git a/apps/dav/tests/unit/DAV/AnonymousOptionsTest.php b/apps/dav/tests/unit/DAV/AnonymousOptionsTest.php
index 87a778e596..22a4b97342 100644
--- a/apps/dav/tests/unit/DAV/AnonymousOptionsTest.php
+++ b/apps/dav/tests/unit/DAV/AnonymousOptionsTest.php
@@ -56,6 +56,12 @@ class AnonymousOptionsTest extends TestCase {
 
 		$this->assertEquals(200, $response->getStatus());
 	}
+
+	public function testAnonymousOptionsNonRootSubDir() {
+		$response = $this->sendRequest('OPTIONS', 'foo/bar');
+
+		$this->assertEquals(401, $response->getStatus());
+	}
 }
 
 class SapiMock extends Sapi {