Files
Yunling Zhang 068ccf7560 fix(webdav): 只读账号拒绝 LOCK/UNLOCK,返回 403
LOCK 会改变服务端锁状态并可能创建资源,属于写操作;
UNLOCK 一并对齐,避免只读账号出现不一致语义。
2026-09-28 17:38:16 +08:00

23 lines
833 B
Go

package server
import (
"net/http"
"strings"
"testing"
)
func TestDAVReadonlyLockForbidden(t *testing.T) {
s, store, _ := newTestServer(t)
_, pass, _ := store.Create("ro", true, "")
body := `<?xml version="1.0"?><D:lockinfo xmlns:D="DAV:"><D:lockscope><D:exclusive/></D:lockscope><D:locktype><D:write/></D:locktype><D:owner>me</D:owner></D:lockinfo>`
rec := request(s, "LOCK", "/ro/lockme.txt", "ro", pass, strings.NewReader(body), map[string]string{"Content-Type": "application/xml"})
if rec.Code != http.StatusForbidden {
t.Fatalf("只读账号 LOCK 应为 403,实际 %d", rec.Code)
}
rec = request(s, "UNLOCK", "/ro/lockme.txt", "ro", pass, nil, map[string]string{"Lock-Token": "<opaquelocktoken:x>"})
if rec.Code != http.StatusForbidden {
t.Fatalf("只读账号 UNLOCK 应为 403,实际 %d", rec.Code)
}
}