DELETE requests work unauthenticated about docker-nginx-webdav-nononsense

[dgraziotin]

@rozhuk-im are you the author of http://netlab.dhis.org/wiki/ru:software:nginx:webdav?

If yes, this bug might affect you, too.

If you have

    location / {
     
      auth_basic "Restricted";
      auth_basic_user_file htpasswd;
[...]
      if ($request_method = DELETE) {
        return 598;
      }
[...]
}
[...]
location @delete_handler {
      internal;
      open_file_cache	off;
      
      if ($destination ~ ^https?://(.*)$) {
        set $new_path $1;
        more_set_input_headers "Destination: http://$new_path";
      }
      
      if (-d $webdav_root/$uri) { # Microsoft specific handle: Add trailing slash to dirs.
        more_set_input_headers "Destination: http://$new_path/";
        rewrite ^(.*[^/])$ $1/ break;
      }
      
      root			$webdav_root;
      dav_methods		DELETE;
    }
[...]

The authentication mechanisms auth_basic and auth_basic_user_file must be repeated in the location @delete_handler, too:

    location / {
     
      auth_basic "Restricted";
      auth_basic_user_file htpasswd;
[...]
      if ($request_method = DELETE) {
        return 598;
      }
[...]
}
[...]
location @delete_handler {
      auth_basic "Restricted";
      auth_basic_user_file htpasswd;
      internal;
      open_file_cache	off;
      
      if ($destination ~ ^https?://(.*)$) {
        set $new_path $1;
        more_set_input_headers "Destination: http://$new_path";
      }
      
      if (-d $webdav_root/$uri) { # Microsoft specific handle: Add trailing slash to dirs.
        more_set_input_headers "Destination: http://$new_path/";
        rewrite ^(.*[^/])$ $1/ break;
      }
      
      root			$webdav_root;
      dav_methods		DELETE;
    }
[...]

Otherwise, nginx will return 403 but delete the files.
Let me know if this issue applies to you, too 👍

Edit: same for @copy_move_handler

[rozhuk-im]

Yes, netlab is mine.
Thanks for pointing that, never think that auth apply only in location that generates reply.

I can not check this, I do not use WebDAV for r/w operations any more, only for share content for kodi with simple minimal DAV config.

May be this will also relevant to you:
arut/nginx-dav-ext-module#55
arut/nginx-dav-ext-module#56

[dgraziotin]

@rozhuk-im all good. Thank you for the Wiki article, it has helped a lot! I can credit you properly in the README now.