Found by the review at #275 (comment): rproxy answers PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK with 405 itself, before discriminator is asked (allowedMethods in internal/rproxy/rproxy.go). Behind smallwebwaf, Nextcloud's Files app cannot list a folder and its sync client cannot sync, which #212 requires. Nextcloud's own exclusions (#275) allow these methods only on its WebDAV paths, through the Core Rule Set's 911100, which keeps refusing them everywhere else.
Definition of done, one PR into next, in internal/rproxy, whose doc says it is the proxy in front of the app:
rproxy passes these nine methods on to discriminator like the methods it passes today. Every other method it does not pass today is still answered 405.
The Allow header and the list under "Requests rproxy refuses itself" in SPEC.md name them.
TestAMethodNotPassedOnIsAnswered405 keeps only methods still answered 405; a test shows a PROPFIND and a LOCK reach the app when discriminator lets them.
A test in internal/coreruleset shows PROPFIND still refused by 911100 at the defaults on a path no app's exclusion covers, such as /.
make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check passes; a flock timeout also exits 1, so read the output. Label the PR needs-review.
Model: opus-5-5
Found by the review at https://git.eeqj.de/sneak/smallwebwaf/pulls/275#issuecomment-173571: `rproxy` answers `PROPFIND`, `PROPPATCH`, `MKCOL`, `COPY`, `MOVE`, `REPORT`, `SEARCH`, `LOCK` and `UNLOCK` with `405` itself, before `discriminator` is asked (`allowedMethods` in `internal/rproxy/rproxy.go`). Behind `smallwebwaf`, Nextcloud's Files app cannot list a folder and its sync client cannot sync, which https://git.eeqj.de/sneak/smallwebwaf/issues/212 requires. Nextcloud's own exclusions (https://git.eeqj.de/sneak/smallwebwaf/pulls/275) allow these methods only on its WebDAV paths, through the Core Rule Set's 911100, which keeps refusing them everywhere else.
**Definition of done**, one PR into `next`, in `internal/rproxy`, whose doc says it is the proxy in front of the app:
- `rproxy` passes these nine methods on to `discriminator` like the methods it passes today. Every other method it does not pass today is still answered `405`.
- The `Allow` header and the list under "Requests `rproxy` refuses itself" in `SPEC.md` name them.
- `TestAMethodNotPassedOnIsAnswered405` keeps only methods still answered `405`; a test shows a `PROPFIND` and a `LOCK` reach the app when `discriminator` lets them.
- A test in `internal/coreruleset` shows `PROPFIND` still refused by 911100 at the defaults on a path no app's exclusion covers, such as `/`.
- `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check` passes; a `flock` timeout also exits 1, so read the output. Label the PR `needs-review`.
Model: opus-5-5
clawbot
self-assigned this 2026-11-10 06:43:48 +01:00
Built in #279: rproxy passes the nine WebDAV methods on; SPEC.md and the Allow header name them. The existing internal/coreruleset test already covers PROPFIND on / refused by 911100.
Model: opus-5-5
Built in https://git.eeqj.de/sneak/smallwebwaf/pulls/279: `rproxy` passes the nine WebDAV methods on; `SPEC.md` and the `Allow` header name them. The existing `internal/coreruleset` test already covers `PROPFIND` on `/` refused by 911100.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Found by the review at #275 (comment):
rproxyanswersPROPFIND,PROPPATCH,MKCOL,COPY,MOVE,REPORT,SEARCH,LOCKandUNLOCKwith405itself, beforediscriminatoris asked (allowedMethodsininternal/rproxy/rproxy.go). Behindsmallwebwaf, Nextcloud's Files app cannot list a folder and its sync client cannot sync, which #212 requires. Nextcloud's own exclusions (#275) allow these methods only on its WebDAV paths, through the Core Rule Set's 911100, which keeps refusing them everywhere else.Definition of done, one PR into
next, ininternal/rproxy, whose doc says it is the proxy in front of the app:rproxypasses these nine methods on todiscriminatorlike the methods it passes today. Every other method it does not pass today is still answered405.Allowheader and the list under "Requestsrproxyrefuses itself" inSPEC.mdname them.TestAMethodNotPassedOnIsAnswered405keeps only methods still answered405; a test shows aPROPFINDand aLOCKreach the app whendiscriminatorlets them.internal/corerulesetshowsPROPFINDstill refused by 911100 at the defaults on a path no app's exclusion covers, such as/.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make checkpasses; aflocktimeout also exits 1, so read the output. Label the PRneeds-review.Model: opus-5-5
Built in #279:
rproxypasses the nine WebDAV methods on;SPEC.mdand theAllowheader name them. The existinginternal/corerulesettest already coversPROPFINDon/refused by 911100.Model: opus-5-5