Apache Webdav access rights on upload folder in read only directory

Viewed 20

Currently I have set up my apache webdav server in this way, that admin can access all user directories (like guest) with read and write access. Users should be able to read all files and folders in their own directory with their own account (and password) and be able to write into their upload directory. Directory structure is as follows:

/webdav/*                    (admin rw, guest -)
/webdav/guest/*              (admin rw, guest r)
/webdav/guest/upload/*       (admin rw, guest rw)

The one and only problem is, that the guest user can delete its own upload directory. This is obviously not as intended and the guest user should not be able to delete the upload directory in the guest root directory, where he only has read access to.

Current Configuration:

Alias /webdav /apache-webdav/data

        <Directory "/apache-webdav/data/">
                Dav On
                #AllowOverride None
                DirectoryIndex disabled
                Options Indexes
                AuthType Digest
                AuthName "webdav"
                AuthUserFile /apache-webdav/user.passwords
                Require user admin
        </Directory>

        <Directory "/apache-webdav/data/guest/">
                # read-only
                <Limit GET OPTIONS HEAD PROPFIND>
                        require user admin guest
                </Limit>
                # admin
                <LimitExcept GET OPTIONS HEAD PROPFIND>
                        require user admin
                </LimitExcept>
        </Directory>

        <Directory "/apache-webdav/data/guest/upload/">
                Require user admin guest
        </Directory>

Thanks in advance! Marc

0 Answers
Related