From 47425d35bbf43bcea1ebabcb7a24b763370ff244 Mon Sep 17 00:00:00 2001 From: codex Date: Sat, 5 Sep 2026 20:41:23 +0200 Subject: [PATCH] Verify denied operations on the actual file-drop DAV endpoint Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883 --- scripts/migrate_nextcloud_backup_account.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/migrate_nextcloud_backup_account.py b/scripts/migrate_nextcloud_backup_account.py index e32fd8e..9667222 100644 --- a/scripts/migrate_nextcloud_backup_account.py +++ b/scripts/migrate_nextcloud_backup_account.py @@ -137,7 +137,8 @@ def run(args, receipt): restored = subprocess_bytes(['age', '-d', '-i', '/dev/stdin', str(cipher)], (values['AGE_PRIVATE_KEY'].strip() + '\n').encode()) require(restored == plain, 'decrypted_fixture_mismatch') for method in ['GET', 'DELETE']: - code, _ = request(HOST + '/public.php/webdav' + fixture_path, method, auth=(token, '')) + code, _ = request(upload_root + fixture_path, method, auth=(token, '')) + receipt['runtime_' + method.lower() + '_http_status'] = code require(code in (401, 403, 404), 'upload_grant_exceeds_create_only') code, present = request(owner_root + fixture_path, auth=auth) require(code == 200 and present == encrypted, 'fixture_not_preserved_by_negative_check')