fix: Handle `Depth` header for `COPY` as this is required by RFC #1495

susnux · 2023-10-25T22:12:43Z

Currently Sabre\DAV does not support the Depth header on COPY and MOVE.
But the RFC4918 requires servers to do so, the header is not required but:

If the header is missing 'infinity' shall be assumed -> This is how we handle every request currently
For MOVE the header, if available, must be 'infinity' -> We just have to check the header and throw bad request otherwise
For COPY the header may 'infinity' or a positive integer including 0
- The depths defines how many levels of children shall be copied
- If the depth is zero only the collection and its properties are copied, but not any children

So especially the COPY method is currently broken, we noticed this when using the WebDAV litmus test bench (version 0.14) which checks for shallow copies (meaning copy a collection with depth 0).

This PR fixes all of this points, while trying to keep backwards compatible. Of cause any using application that implements ICopyTarget::copyInto is still broken and need to adapt to the depth change (it continues to work as before, but the bug fix does not propagate).

Reference from the RFC:

The requirement on the server support of COPY Depth 'infinity' and '0': rfc4918#section-9.8.3
For MOVE only Depth: infinity is allowed: rfc4918#section-9.9.2

lib/DAV/Server.php

susnux · 2024-04-04T14:14:21Z

ping again, also cc @phil-davis

Would be great to get this fixed so sabre passes the litmus test v15 ( https://github.com/notroj/litmus previously http://www.webdav.org/neon/litmus/ )

susnux · 2024-08-13T13:07:49Z

Anything I can help with to get this reviewed? (I do not want to bug you but this would be a great to get fixed :) ).

DeepDiver1975 · 2024-09-05T09:42:26Z

I miss the ci status - what's going on here?

DeepDiver1975 · 2024-09-05T09:44:38Z

I miss the ci status - what's going on here?

@susnux can I ask you to rebase this pull request ... THX

susnux · 2024-09-05T13:31:10Z

can I ask you to rebase this pull request ... THX

@DeepDiver1975 sure, done!

Noticed I had some code style issues / compatibility issues because I was using PHP 8+ syntax and tests use PHP 7.4. This is now fixed.

codecov · 2024-09-05T13:48:41Z

Codecov Report

❌ Patch coverage is 96.42857% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 97.25%. Comparing base (ed901a9) to head (25fc0c2).
⚠️ Report is 12 commits behind head on master.

Files with missing lines	Patch %	Lines
lib/DAV/Tree.php	93.33%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #1495      +/-   ##
============================================
+ Coverage     97.23%   97.25%   +0.02%     
- Complexity     2836     2842       +6     
============================================
  Files           175      175              
  Lines          9028     8864     -164     
============================================
- Hits           8778     8621     -157     
+ Misses          250      243       -7

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

susnux · 2025-01-29T09:39:58Z

Noticed it is still open, is there anything I can help with?

lib/DAV/Server.php

kesselb · 2025-06-26T11:36:15Z

cc @susnux can you rebase, to have a recent ci run?

susnux · 2025-06-26T11:48:49Z

can you rebase, to have a recent ci run?

Sure, done

tests/Sabre/DAV/ServerCopyMoveTest.php

lib/DAV/Server.php

susnux · 2025-06-26T16:22:19Z

@kesselb I pushed a commit solving your comments

susnux · 2025-10-10T12:54:55Z

@phil-davis anything else to do, to get this PR merged?

lib/DAV/Server.php

alecpl · 2025-11-19T11:04:54Z

lib/DAV/CorePlugin.php

        $moveInfo = $this->server->getCopyAndMoveInfo($request);

+        // MOVE does only allow "infinity" every other header value is considered invalid
+        if (Server::DEPTH_INFINITY !== $moveInfo['depth']) {


I'm not sure this is the best place for this check. When dealing with files Depth should be ignored. So, maybe to be on a safe side we should do this check for collections only.

For MOVE the RFC is not that explicit but for COPY it is and there we have this part of the RFC:

Please note, however, that it is always an error to submit a value for the Depth header that is not allowed by the method's definition. Thus submitting a "Depth: 1" on a COPY, even if the resource does not have internal members, will result in a 400 (Bad Request). The method should fail not because the resource doesn't have internal members, but because of the illegal value in the header.

Thus an invalid value of the header has higher priority than the header itself.
So I think throwing here is safe and indicates that the client needs to be fixed.

alecpl · 2025-11-19T11:05:45Z

I just find out about this missing bit. I'd love to see this merged.

Only `Depth: infinity` is allowed, ref: rfc4918#section-9.9.2 Signed-off-by: Ferdinand Thiessen <[email protected]>

1. According to the RFC[1] servers **must** support `Depth` 'infinity' and 0. 2. And COPY method on a collection without a Depth header MUST act as if a Depth header with value "infinity" was included. [1] rfc4918#section-9.8.3 Signed-off-by: Ferdinand Thiessen <[email protected]>

Signed-off-by: Ferdinand Thiessen <[email protected]>

…of string value Signed-off-by: Ferdinand Thiessen <[email protected]>

susnux · 2025-11-19T16:01:15Z

Rebased to fix the typo in the error message - otherwise no changes.

susnux mentioned this pull request Oct 25, 2023

Upgrade Litmus to 0.15 nextcloud/server#39627

Open

DeepDiver1975 requested changes Nov 8, 2023

View reviewed changes

lib/DAV/Server.php Outdated Show resolved Hide resolved

susnux requested a review from DeepDiver1975 February 21, 2024 17:08

phil-davis self-assigned this Apr 18, 2024

DeepDiver1975 approved these changes Sep 5, 2024

View reviewed changes

susnux force-pushed the fix/handle-depth branch from 1076773 to 069c16d Compare September 5, 2024 13:30

susnux force-pushed the fix/handle-depth branch from 8dc4522 to 3e722c3 Compare September 5, 2024 13:46

This was referenced Jun 17, 2025

feat: Add litmus test image with current PHP version (8.3) nextcloud/docker-ci#634

Merged

Update neon litmus library nextcloud/docker-ci#788

Open

ChristophWurst approved these changes Jun 26, 2025

View reviewed changes

lib/DAV/Server.php Outdated Show resolved Hide resolved

susnux force-pushed the fix/handle-depth branch from e911e4c to 7930b55 Compare June 26, 2025 11:48

kesselb reviewed Jun 26, 2025

View reviewed changes

tests/Sabre/DAV/ServerCopyMoveTest.php Outdated Show resolved Hide resolved

tests/Sabre/DAV/ServerCopyMoveTest.php Show resolved Hide resolved

lib/DAV/Server.php Outdated Show resolved Hide resolved

susnux requested a review from kesselb June 26, 2025 16:01

susnux force-pushed the fix/handle-depth branch 2 times, most recently from b580c46 to 1af1212 Compare June 26, 2025 16:18

alecpl reviewed Nov 19, 2025

View reviewed changes

susnux added 2 commits November 19, 2025 16:58

fix(CorePlugin): Handle Depth header in HTTP MOVE

c3c3a2f

Only `Depth: infinity` is allowed, ref: rfc4918#section-9.9.2 Signed-off-by: Ferdinand Thiessen <[email protected]>

susnux added 2 commits November 19, 2025 16:58

chore: Fix code style

500aad5

Signed-off-by: Ferdinand Thiessen <[email protected]>

refactor: use the existing Server::DEPTH_INFINITY constant instead …

25fc0c2

…of string value Signed-off-by: Ferdinand Thiessen <[email protected]>

susnux force-pushed the fix/handle-depth branch from 61a7246 to 25fc0c2 Compare November 19, 2025 16:00

fix: Handle Depth header for COPY as this is required by RFC #1495

Are you sure you want to change the base?

fix: Handle Depth header for COPY as this is required by RFC #1495

Uh oh!

Conversation

susnux commented Oct 25, 2023

Uh oh!

Uh oh!

susnux commented Apr 4, 2024

Uh oh!

susnux commented Aug 13, 2024

Uh oh!

DeepDiver1975 commented Sep 5, 2024

Uh oh!

DeepDiver1975 commented Sep 5, 2024

Uh oh!

susnux commented Sep 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Sep 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

susnux commented Jan 29, 2025

Uh oh!

Uh oh!

kesselb commented Jun 26, 2025

Uh oh!

susnux commented Jun 26, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

susnux commented Jun 26, 2025

Uh oh!

susnux commented Oct 10, 2025

Uh oh!

Uh oh!

alecpl Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

susnux Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

alecpl commented Nov 19, 2025

Uh oh!

susnux commented Nov 19, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

fix: Handle `Depth` header for `COPY` as this is required by RFC #1495

fix: Handle `Depth` header for `COPY` as this is required by RFC #1495

susnux commented Sep 5, 2024 •

edited

Loading

codecov bot commented Sep 5, 2024 •

edited

Loading