Arkadiusz Juszczyk 828691e3c4 sharing: URL-encode-aware backmap of REPORT/PROPPATCH hrefs ...

make_href percent-encodes hrefs (an '@' in an email principal becomes
%40), but the backmap compared against the raw PathMapped, so the
rewrite was skipped and the owner's real path leaked -- editing a shared
collection then failed with 403. Compare and rewrite on the quoted form.

2026-06-24 01:02:28 +02:00

13 KiB

Raw Blame History

View Raw