Move files expose complete folder structure on public links

[schiessle]

• Share a folder with some files as public link with edit permissions
• open the public link
• the "three dot menu" of the files will show the "move" operation
• click on it

Result:

You see the root of the users files folder. You can move the files to any location and look at the complete folder structure of the user

Expected:

Only show folders within the shared folder

cc @icewind1991

[LukasReschke]

I think that is because the WebDAV call is performed with the wrong credentials. Can you try in a private tab?

So there is no actual real loss of information but simply the credentials of the logged-in users used. At least from how I understand the code.

[LukasReschke]

Yep. Move seems to connect against /remote.php/webdav instead /public.php/webdav

cc @icewind1991 Can you take a look? THX :)

[schiessle]

yes, in a private tab we don't expose the whole directory structure but the dialog is still broken. It shows a spinner and "Problem loading page, reloading in 5 seconds"