From 0d3146b51d2c68a08b39473d3305c1eb1811c763 Mon Sep 17 00:00:00 2001 From: Andy Hsu Date: Thu, 23 Feb 2023 21:19:50 +0800 Subject: [PATCH] fix(webdav): disable put with empty path (close #3569) --- server/webdav/webdav.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/webdav/webdav.go b/server/webdav/webdav.go index 9f856e4f..3485fc80 100644 --- a/server/webdav/webdav.go +++ b/server/webdav/webdav.go @@ -296,6 +296,9 @@ func (h *Handler) handlePut(w http.ResponseWriter, r *http.Request) (status int, if err != nil { return status, err } + if reqPath == "" { + return http.StatusMethodNotAllowed, nil + } release, status, err := h.confirmLocks(r, reqPath, "") if err != nil { return status, err