Subject: Re: [ACL] Lock owners

From: Julian Reschke <[email-masked]>
Date: Mon, 28 May 2007 19:48:52 +0200

Mr. Demeanour wrote:
> Hi,
> 
> The UNLOCK method requires the <unlock/> privilege, unless the user is
> the owner of the lock, in which case no privilege is required (just the
> lock token).

Yes.

> How is it possible to tell whether the owner of a lock is the current
> user? If the user is authenticated, then he is a principal; but there is
> nothing to link the owner of a lock to a principal, since the <owner>
> element is defined to contain an arbitrary string.

Yes. What you're looking for is the *creator* of the lock 
(<http://greenbytes.de/tech/webdav/draft-ietf-webdav-rfc2518bis-18.html#lock-creator>), 
which is not exposed with the lock.

> So is it intended that the <owner> for a lock is simply anyone who has a
> copy of the token? But anyone can get the token, just by doing
> lockdiscovery.

No, that's not the intention.

> So when is the <unlock/> privilege required? Does any existing server
> enforce the <unlock/> privilege?

The one we wrote certainly does, and I expect the same applies to many 
others.

How is this a problem?

Best regards, Julian

---

From: "Tim Olsen" <[email-masked]>
Date: Tue, 29 May 2007 08:14:52 -0400

On 5/29/07, Mr. Demeanour <[email-masked]> wrote:
> So am I right in concluding that lock-null resources have been abandoned?
>
> How would that be expected to affect interop with existing clients and
> servers?
>
> As far as I can see, it must mean this: previously, when a lock was
> removed on a lock-null resource, the resource was removed. Under this
> change the resource survives.
>
> Is that right?

It also means you can't LOCK an unmapped URI and then MKCOL.  I'm not
sure, but I think this might cause problems with Dreamweaver.

-Tim

> --
> Jack.