Skip to content

[stable26] fix(dav): Do not respond version/trashbin download requests with 404 due to ChunkingV2Plugin#62108

Open
DerDreschner wants to merge 1 commit into
stable26from
backport/61680/stable26
Open

[stable26] fix(dav): Do not respond version/trashbin download requests with 404 due to ChunkingV2Plugin#62108
DerDreschner wants to merge 1 commit into
stable26from
backport/61680/stable26

Conversation

@DerDreschner

Copy link
Copy Markdown
Contributor

Backport of #61680

…due to ChunkingV2Plugin

ChunkingV2Plugin::beforeGet eagerly resolves the request path during
beforeMethod:GET to block reading intermediate chunked uploads. App-provided
DAV collections (versions, trashbin) are attached to the root lazily in a
beforeMethod:* closure in Server.php, while uploads is registered eagerly. When
beforeGet runs before that closure, getNodeForPath() throws NotFound and aborts
the whole request, turning every GET under /dav/versions/ and /dav/trashbin/
into "404 File not found: versions in 'root'". PROPFIND is unaffected, since
nothing resolves the path that early for it.

This does not currently surface on master only by accident of listener ordering:
beforeGet and the collection closure share the default priority, and because
beforeGet is registered as a first-class callable (a Closure), the wildcard
closure happens to sort before it, so the collections are already attached by the
time beforeGet resolves the path. That ordering is not guaranteed -- it depends on
how equal-priority listeners are tie-broken -- so the unguarded resolution is a
latent fault that any reordering can expose. On stable 28 it is already broken,
because the backport registered the handler as an array callable, which tie-breaks
the other way and runs beforeGet first.

Catch NotFound in beforeGet and bail out: a path that cannot be resolved is by
definition not an intermediate upload. This removes the dependency on listener
ordering entirely and makes the handler consistent with
beforePut()/beforeMove()/beforeDelete(), which already swallow NotFound for the
same reason.

Add a ChunkingV2Plugin unit test (the NotFound case is the regression guard) and
a file-versions integration scenario covering a real version download.

Assisted-by: ClaudeCode:claude-opus-4-8[1m]
Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>
@DerDreschner DerDreschner self-assigned this Jul 14, 2026
@DerDreschner DerDreschner added 4. to release Ready to be released and/or waiting for tests to finish feature: dav regression AI assisted labels Jul 14, 2026
@DerDreschner DerDreschner marked this pull request as ready for review July 14, 2026 14:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

4. to release Ready to be released and/or waiting for tests to finish AI assisted feature: dav regression

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant