Subject: DAV 'drop box'

From: Tristan Fiedler <[email-masked]>
Date: Tue, 19 Dec 2006 15:47:57 -0500

I am using a DAV server for a project where authorized users will 
upload large data files to our DAV site (linux running apache).  I have 
been able to set up the apache directives to allow users to upload 
files, but wanted to know if there is a way to allow *only* file 
uploads, and thus prevent users from reading files already present in 
the DAV directory, and also from deleting/downloading files already 
present in the DAV directory.

Basically, I am attempting to create a "drop box" where users must 
login, then can upload their file but not delete or read material 
already present on the DAV folder.  I currently have the httpd.conf 
file :

    <Location /dav_directory>
    DAV On
    AllowOverride None
    Options +Indexes
    AuthType Basic
    AuthName "authorization"
    AuthUserFile /path/to/passwd/file
    <Limit GET OPTIONS PUT POST DELETE PROPFIND PROPPATCH MKCOL COPY 
MOVE LOCK UNLOCK>
        Require user foobar
    </Limit>
</Location>

Many thanks for any assistance!

---

From: Sean Davis <[email-masked]>
Date: Wed, 20 Dec 2006 10:32:29 -0500

Tristan Fiedler wrote:
> upload large data files to our DAV site (linux running apache).  I 
> have been able to set up the apache directives to allow users to 
> upload files, but wanted to know if there is a way to allow *only* 
> file uploads, and thus prevent users from reading files already 
> present in the DAV directory, and also from deleting/downloading files 
> already present in the DAV directory.
>
I asked this last year and I don't think things have changed.  It isn't 
possible to create an ftp-like drop box using webDAV.

Sean

---

From: Julian Reschke <[email-masked]>
Date: Wed, 20 Dec 2006 19:02:26 +0100

Sean Davis schrieb:
> ...

Well, that's not a protocol restriction, but an implementation restriction.

Best regards, Julian

---

From: Tristan Fiedler <[email-masked]>
Date: Wed, 20 Dec 2006 16:01:35 -0500

Thank you all for the replies.  Removing GET applies to the 'Require 
user' directive I believe. Thus removing GET leaves this method 
unprotected.  See http://httpd.apache.org/docs/1.3/mod/core.html#limit

  However, changing directory permissions to 'd-wx-wx-wt' seems to do 
the job.

On Dec 20, 2006, at 3:15 PM, Alex Jalali wrote:

> I'm not that familiar with apache permissions but wouldn't removing 
> GET,
> DELETE ect from limit do what you need?
>
>> have

---

From: "Alex Jalali" <[email-masked]>
Date: Wed, 20 Dec 2006 12:15:23 -0800 (PST)

I'm not that familiar with apache permissions but wouldn't removing GET,
DELETE ect from limit do what you need?

---

From: Sean Davis <[email-masked]>
Date: Thu, 21 Dec 2006 09:08:35 -0500

>   However, changing directory permissions to 'd-wx-wx-wt' seems to do

This works for me.  Thanks, Tristan.

Sean