Merge pull request #196 from n-iv/fix/webdav-redirect-preserve-method

fix: preserve method and URI when redirecting WebDAV through GSS

Author: ArtificialOwl

lib/ConfigLexicon.php

@@ -17,6 +17,7 @@
 class ConfigLexicon implements ILexicon {
 	public const GS_TOKENS = 'globalScaleTokens';
 	public const LOCAL_TOKEN = 'localToken';
+    public const REDIRECT_WEBDAV = 'redirectWebDAV';
 
 	#[\Override]
 	public function getStrictness(): Strictness {
@@ -31,6 +32,7 @@ public function getAppConfigs(): array {
 		return [
 			new Entry(key: self::GS_TOKENS, type: ValueType::ARRAY, defaultRaw: [], definition: 'list of token+host to navigate through GlobalScale', lazy: true),
 			new Entry(key: self::LOCAL_TOKEN, type: ValueType::STRING, defaultRaw: '', definition: 'local token to id instance within GlobalScale', lazy: true),
+			new Entry(key: self::REDIRECT_WEBDAV, type: ValueType::BOOL, defaultRaw: false, definition: 'redirect WebDAV request on Master to Slaves', lazy: false),
 		];
 	}
 

lib/Master.php

@@ -13,13 +13,15 @@
 use OC\Core\Controller\ClientFlowLoginV2Controller;
 use OC\Core\Service\LoginFlowV2Service;
 use OCA\GlobalSiteSelector\AppInfo\Application;
+use OCA\GlobalSiteSelector\ConfigLexicon;
 use OCA\GlobalSiteSelector\UserDiscoveryModules\IUserDiscoveryModule;
 use OCA\GlobalSiteSelector\Vendor\Firebase\JWT\JWT;
 use OCA\GlobalSiteSelector\Vendor\Firebase\JWT\Key;
 use OCP\AppFramework\Http\StandaloneTemplateResponse;
 use OCP\Authentication\IApacheBackend;
 use OCP\HintException;
 use OCP\Http\Client\IClientService;
+use OCP\IAppConfig;
 use OCP\IConfig;
 use OCP\IRequest;
 use OCP\ISession;
@@ -48,6 +50,7 @@ public function __construct(
 		private readonly Lookup $lookup,
 		private readonly IRequest $request,
 		private readonly IClientService $clientService,
+        private readonly IAppConfig $appConfig,
 		private readonly IConfig $config,
 		private readonly LoggerInterface $logger,
 	) {
@@ -272,6 +275,14 @@ protected function redirectUser($uid, $password, $location, array $options = [])
 		// check for both possible direct webdav end-points
 		$isDirectWebDavAccess = strpos($requestUri, 'remote.php/webdav') !== false;
 		$isDirectWebDavAccess = $isDirectWebDavAccess || strpos($requestUri, 'remote.php/dav') !== false;
+
+        $authHeader = $this->request->getHeader('Authorization');
+        $redirectWebDav = $this->appConfig->getValueBool(Application::APP_ID, ConfigLexicon::REDIRECT_WEBDAV);
+        $hasBasicAuth = $redirectWebDav && $authHeader !== '' && str_starts_with(strtolower($authHeader), 'basic ');
+
+		// default redirect status code; overridden below for the 307 forward.
+		$statusCode = 302;
+
 		// direct webdav access with old client or general purpose webdav clients
 		if ($isClient && $isDirectWebDavAccess) {
 			$this->logger->debug('redirectUser: client direct webdav request');
@@ -289,14 +300,26 @@ protected function redirectUser($uid, $password, $location, array $options = [])
 				// fallback to v1
 				$redirectUrl = 'nc://login/server:' . $location . '&user:' . urlencode($uid) . '&password:' . urlencode($appToken);
 			}
+		} elseif ($isDirectWebDavAccess && $hasBasicAuth) {
+			// Third-party WebDAV clients authenticated with HTTP Basic
+			// (curl, rclone, davfs2, sabre/dav based clients, generic DAV
+			// consumers, etc.): forward the request as-is to the slave with
+			// a 307 (RFC 9110 §15.4.8) so that PUT, PROPFIND, MKCOL, DELETE,
+			// COPY and MOVE are not downgraded to GET, and the original
+			// request URI is preserved end-to-end. The client re-issues the
+			// same request to the slave, including the Authorization header
+			// it already presented to the master.
+			$this->logger->debug('redirectUser: third-party webdav request with Basic Auth, forwarding with 307');
+			$redirectUrl = rtrim($location, '/') . $requestUri;
+			$statusCode = 307;
 		} else {
 			$this->logger->debug('redirectUser: direct login so forward to target node');
 			$jwt = $this->createJwt($uid, $password, $options);
 			$redirectUrl = $location . '/index.php/apps/globalsiteselector/autologin?jwt=' . $jwt;
 		}
 
 		$this->logger->debug('redirectUser: redirecting to: ' . $redirectUrl);
-		header('Location: ' . $redirectUrl, true, 302);
+		header('Location: ' . $redirectUrl, true, $statusCode);
 		die();
 	}