hfs 3.1.0-beta4 → 3.1.0-beta6

package/src/log.js

@@ -101,7 +101,7 @@ const logUA = (0, config_1.defineConfig)(misc_1.CFG.log_ua, false);
 const logSpam = (0, config_1.defineConfig)(misc_1.CFG.log_spam, false);
 const debounce = lodash_1.default.debounce(cb => cb(), 1000); // with this technique, i'll be able to debounce some code respecting the references in its closure
 const logMw = async (ctx, next) => {
-    const now = new Date(); // request start
+    const reqStart = new Date(); // request start
     const userAtStart = (0, auth_1.getCurrentUsername)(ctx);
     // do it now so it's available for returning plugins
     ctx.state.completed = Promise.race([(0, events_1.once)(ctx.res, 'finish'), (0, events_1.once)(ctx.res, 'close')]);
@@ -130,13 +130,14 @@ const logMw = async (ctx, next) => {
         let { stream, last, path } = logger;
         if (!stream)
             return;
-        logger.last = now;
+        logger.last = reqStart;
         if (rotate && last) { // rotation enabled and a file exists?
-            const passed = Number(now) - Number(last)
+            const passed = Number(reqStart) - Number(last)
                 - 3600_000; // be pessimistic and count a possible DST change
-            if (rotate === 'm' && (passed >= 31 * misc_1.DAY || now.getMonth() !== last.getMonth())
-                || rotate === 'd' && (passed >= misc_1.DAY || now.getDate() !== last.getDate()) // checking passed will solve the case when the day of the month is the same but a month has passed
-                || rotate === 'w' && (passed >= 7 * misc_1.DAY || now.getDay() < last.getDay())) {
+            const t = reqStart;
+            if (rotate === 'm' && (passed >= 31 * misc_1.DAY || t.getMonth() !== last.getMonth())
+                || rotate === 'd' && (passed >= misc_1.DAY || t.getDate() !== last.getDate()) // checking passed will solve the case when the day of the month is the same but a month has passed
+                || rotate === 'w' && (passed >= 7 * misc_1.DAY || t.getDay() < last.getDay())) {
                 stream.end();
                 const suffix = '-' + last.getFullYear() + '-' + doubleDigit(last.getMonth() + 1) + '-' + doubleDigit(last.getDate());
                 const newPath = (0, misc_1.strinsert)(path, path.length - (0, path_1.extname)(path).length, suffix);
@@ -152,12 +153,13 @@ const logMw = async (ctx, next) => {
             }
         }
         const format = '%s - %s [%s] "%s %s HTTP/%s" %d %s %s\n'; // Apache's Common Log Format
-        const a = now.toString().split(' '); // like nginx, our default log contains the time of log writing
-        const date = a[2] + '/' + a[1] + '/' + a[3] + ':' + a[4] + ' ' + a[5]?.slice(3);
+        // keep reqStart for duration/rotation, but log time should reflect when the line is actually written
+        const a = new Date().toString().split(' '); // like nginx, our default log contains the time of log writing
+        const date = `${a[2]}/${a[1]}/${a[3]}:${a[4]} ${a[5]?.slice(3)}`;
         const user = (0, auth_1.getCurrentUsername)(ctx) || userAtStart;
         const length = ctx.state.length ?? ctx.length;
         const uri = ctx.originalUrl;
-        const duration = (Date.now() - Number(now)) / 1000;
+        const duration = (Date.now() - Number(reqStart)) / 1000;
         ctx.logExtra(ctx.vfsNode && {
             speed: Math.round(length / duration),
             ...ctx.state.includesLastByte && ctx.res.finished && { dl: 1 }
@@ -172,7 +174,7 @@ const logMw = async (ctx, next) => {
             ctx.logExtra({ ua: ctx.get('user-agent') || undefined });
         const extra = ctx.state.logExtra;
         if (events_2.default.anyListener(logger.name)) // small optimization: this event can happen often, while most times there's no listener, and the parameters object is constructed pointlessly. A benchmark measured it 20% faster (just the line), while maybe it was not necessary.
-            events_2.default.emit(logger.name, { ctx, length, user, ts: now, uri, extra });
+            events_2.default.emit(logger.name, { ctx, length, user, ts: reqStart, uri, extra });
         debounce(() => // once in a while we check if the file is still good (not deleted, etc), or we'll reopen it
          (0, util_files_1.statWithTimeout)(logger.path).catch(() => logger.reopen())); // async = smoother but we may lose some entries
         stream.write(util.format(format, ctx.ip, user || '-', date, ctx.method, uri, ctx.req.httpVersion, ctx.status, length?.toString() ?? '-', lodash_1.default.isEmpty(extra) ? '' : JSON.stringify(JSON.stringify(extra))));

package/src/makeQ.js

@@ -1,27 +1,33 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeQ = makeQ;
-function makeQ(parallelization = 1) {
+const asap = globalThis.setImmediate || setTimeout;
+function makeQ(parallelization = 1, max = Infinity) {
     const running = new Set();
     const queued = [];
     return {
         add(toAdd) {
+            if (queued.length >= max + parallelization - running.size) // we may have some free slots that will be used at the next tick
+                return false;
             queued.push(toAdd);
-            setTimeout(startNextIfPossible); // avoid nesting/stacking of jobs
+            asap(startNextIfPossible); // avoid calling now, as it would cause nesting/stacking of jobs
+            return true;
         },
         isWorking() { return running.size > 0; },
         isFree() { return running.size < parallelization; },
+        setMax(newMax) { max = newMax; },
+        queueSize() { return queued.length; },
     };
     function startNextIfPossible() {
         while (running.size < parallelization) {
-            const job = queued.pop();
+            const job = queued.shift();
             if (!job)
                 break; // finished
             const working = job(); // start the job
             if (!working)
                 continue; // it was canceled
             running.add(working);
-            working.then(() => {
+            working.finally(() => {
                 running.delete(working);
                 startNextIfPossible();
             });

package/src/multipartUpload.js

@@ -11,6 +11,7 @@ const path_1 = require("path");
 const upload_1 = require("./upload");
 const cross_const_1 = require("./cross-const");
 const first_1 = require("./first");
+const cross_1 = require("./cross");
 async function handleMultipartUpload(ctx, node) {
     if (ctx.request.type !== 'multipart/form-data')
         return ctx.status = cross_const_1.HTTP_BAD_REQUEST;
@@ -18,7 +19,12 @@ async function handleMultipartUpload(ctx, node) {
     const locks = [];
     const fileJobs = [];
     const errors = [];
-    const bb = (0, busboy_1.default)({ headers: ctx.req.headers, preservePath: true });
+    const bb = (0, cross_1.try_)(() => (0, busboy_1.default)({ headers: ctx.req.headers, preservePath: true }), e => {
+        ctx.body = String(e); // busboy validates multipart headers at construction time, so malformed requests must stop here as 400
+        ctx.status = cross_const_1.HTTP_BAD_REQUEST;
+    });
+    if (!bb)
+        return;
     bb.on('field', (name) => {
         if (name === 'upload')
             errors.push('empty filename');

package/src/serveGuiAndSharedFiles.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.serveGuiAndSharedFiles = void 0;
+exports.serveSharedFiles = exports.guiFilesMiddleware = void 0;
 const path_1 = require("path");
 const vfs_1 = require("./vfs");
 const errorPages_1 = require("./errorPages");
@@ -28,12 +28,11 @@ const comments_1 = require("./comments");
 const basicWeb_1 = require("./basicWeb");
 const icons_1 = require("./icons");
 const plugins_1 = require("./plugins");
-const webdav_1 = require("./webdav");
 const serveFrontendFiles = (0, serveGuiFiles_1.serveGuiFiles)(process.env.FRONTEND_PROXY, cross_const_1.FRONTEND_URI);
 const serveFrontendPrefixed = (0, koa_mount_1.default)(cross_const_1.FRONTEND_URI.slice(0, -1), serveFrontendFiles);
 const serveAdminFiles = (0, serveGuiFiles_1.serveGuiFiles)(process.env.ADMIN_PROXY, cross_const_1.ADMIN_URI);
 const serveAdminPrefixed = (0, koa_mount_1.default)(cross_const_1.ADMIN_URI.slice(0, -1), serveAdminFiles);
-const serveGuiAndSharedFiles = async (ctx, next) => {
+const guiFilesMiddleware = async (ctx, next) => {
     const { path } = ctx;
     // dynamic import on frontend|admin (used for non-https login) while developing (vite4) is not producing a relative path
     if (const_1.DEV && path.startsWith('/node_modules/')) {
@@ -59,15 +58,18 @@ const serveGuiAndSharedFiles = async (ctx, next) => {
         ctx.state.considerAsGui = true;
         return (0, serveFile_1.serveFile)(ctx, (0, path_1.join)(plugin?.folder || '', icons_1.ICONS_FOLDER, file), const_1.MIME_AUTO);
     }
-    if (await (0, webdav_1.handledWebdav)(ctx))
-        return;
+    return next();
+};
+exports.guiFilesMiddleware = guiFilesMiddleware;
+const serveSharedFiles = async (ctx, next) => {
+    const { path } = ctx;
     const { get } = ctx.query;
     const getUploadTempHash = get === cross_const_1.UPLOAD_TEMP_HASH;
     if (ctx.method === 'PUT' || getUploadTempHash) { // PUT is what you get with `curl -T file url/`
         const decPath = (0, misc_1.safeDecodeURIComponent)(path, '');
         const fn = (0, path_1.basename)(decPath);
         const folderUri = (0, misc_1.pathEncode)((0, path_1.dirname)(decPath)); // re-encode to get readable urls
-        const folder = await (0, vfs_1.urlToNode)(folderUri, ctx, vfs_1.vfs, true);
+        const folder = await (0, vfs_1.urlToNode)(folderUri, ctx, vfs_1.vfs, true); // we don't require the folder to already exist, but to be mapped on disk AND to have proper permissions
         if (!folder)
             return (0, errorPages_1.sendErrorPage)(ctx, cross_const_1.HTTP_NOT_FOUND);
         ctx.state.uploadPath = decPath;
@@ -149,7 +151,7 @@ const serveGuiAndSharedFiles = async (ctx, next) => {
         : get === 'list' ? sendFolderList(node, ctx)
             : ((0, basicWeb_1.basicWeb)(ctx, node) || serveFrontendFiles(ctx, next));
 };
-exports.serveGuiAndSharedFiles = serveGuiAndSharedFiles;
+exports.serveSharedFiles = serveSharedFiles;
 async function sendFolderList(node, ctx) {
     if ((await events_1.default.emitAsync('getList', { node, ctx }))?.isDefaultPrevented())
         return;
@@ -161,7 +163,7 @@ async function sendFolderList(node, ctx) {
             || URL.protocol + '//' + URL.host + ctx.state.revProxyPath;
         prepend = base + (0, misc_1.pathEncode)(decodeURI(ctx.path)); // redo the encoding our way, keeping unicode chars unchanged
     }
-    const walker = (0, vfs_1.walkNode)(node, { ctx, depth: depth === '*' ? Infinity : Number(depth), parallelizeRecursion: false });
+    const walker = (0, vfs_1.walkNode)(node, { ctx, depth: depth === '*' ? Infinity : Number(depth), parallelizeRecursion: false }); // parallelization produces out-of-order results, and we don't want it like that here
     ctx.body = (0, misc_1.asyncGeneratorToReadable)((0, misc_1.filterMapGenerator)(walker, async (el) => {
         const isFolder = (0, vfs_1.nodeIsFolder)(el);
         return !folders && isFolder ? undefined

package/src/serveGuiFiles.js

@@ -90,6 +90,7 @@ async function treatIndex(ctx, filesUri, body) {
                 VERSION: const_1.VERSION,
                 API_VERSION: const_1.API_VERSION,
                 SPECIAL_URI: const_1.SPECIAL_URI, PLUGINS_PUB_URI: const_1.PLUGINS_PUB_URI, FRONTEND_URI: const_1.FRONTEND_URI,
+                pathSeparator: path_1.sep,
                 session: session instanceof apiMiddleware_1.ApiError ? null : session,
                 plugins,
                 loadScripts: Object.fromEntries((0, plugins_1.mapPlugins)((p, id) => [id, p.frontend_js?.map(f => f.includes('//') ? f : pub + id + '/' + f)])),
@@ -174,7 +175,7 @@ function serveProxied(port, uri) {
     return function (ctx, next) {
         if (!exports.logGui.get())
             ctx.state.dontLog = true;
-        return proxy(ctx, next);
+        return proxy(ctx, async () => { });
     };
 }
 function serveGuiFiles(proxyPort, uri) {

package/src/throttler.js

@@ -57,7 +57,8 @@ const throttler = async (ctx, next) => {
         if (outSpeed || !closed)
             conn[SymTimeout] = setTimeout(update, DELAY);
     }, DELAY, { leading: true, maxWait: DELAY });
-    ts.on('sent', (n) => {
+    ts.on('sent', async (n) => {
+        await exports.totalSent.ready();
         exports.totalSent.set(x => x + n);
         update();
     });

package/src/update.js

@@ -134,13 +134,16 @@ async function update(tagOrUrl = '') {
     }
     if (url) {
         console.log("downloading", url);
+        const temp = LOCAL_UPDATE + '-temp';
+        await (0, promises_1.rm)(temp, { force: true });
         try {
-            await (0, promises_1.writeFile)(LOCAL_UPDATE, await (0, misc_1.httpStream)(url));
+            await (0, promises_1.writeFile)(temp, await (0, misc_1.httpStream)(url));
         }
         catch (e) {
-            await (0, promises_1.rm)(LOCAL_UPDATE).catch(() => { }); // no leftovers
+            await (0, promises_1.rm)(temp).catch(() => { }); // no leftovers
             throw "Download failed for " + url + (0, misc_1.prefix)(' – ', e?.message);
         }
+        await (0, promises_1.rename)(temp, LOCAL_UPDATE);
         console.debug("download finished");
     }
     const bin = process.execPath;

package/src/upload.js

@@ -66,12 +66,13 @@ function uploadWriter(base, baseUri, filename, ctx) {
     // enforce minAvailableMb
     const min = exports.minAvailableMb.get() * (1 << 20);
     const { simulate } = ctx.query; // `simulate` is used to get the same error but with an empty body, so that the request is processed quickly
-    const contentLength = Number(simulate || ctx.headers["content-length"]);
-    const isPartial = ctx.query.partial !== undefined; // while the presence of "partial" conveys the upload is split...
+    const contentLength = Number(simulate ?? ctx.headers["content-length"]
+        ?? ctx.headers['x-expected-entity-length']); // some webdav clients send this; it's not equivalent to content-length, but can get the job done in some cases
+    const isPartial = ctx.query.partial !== undefined; // while the presence of "partial" conveys that the upload is split...
     const stillToWrite = Math.max(contentLength, Number(ctx.query.partial) || 0); // ...the number is used to tell how much space we need (fullSize - offset)
     if (isNaN(stillToWrite)) {
         if (min)
-            return fail(const_1.HTTP_BAD_REQUEST, 'content-length mandatory');
+            return fail(const_1.HTTP_LENGTH_REQUIRED);
     }
     else
         try {

package/src/util-os.js

@@ -84,15 +84,39 @@ async function getWindowsServicePids() {
     const no = parsed?.[1]?.[2];
     return Object.fromEntries(parsed.slice(2).filter(x => x[2] !== no).map(x => [x[1], x[2]]));
 }
-exports.RUNNING_AS_SERVICE = const_1.IS_WINDOWS && getWindowsServicePids().then(x => {
-    const ret = x[node_process_1.pid] || x[node_process_1.ppid];
+exports.RUNNING_AS_SERVICE = detectRunningAsService().then(ret => {
     if (ret)
         console.log("running as service", ret);
     return ret;
 }, e => {
     console.log("couldn't determine if we are running as a service");
     console.debug(e);
+    return false;
 });
+async function detectRunningAsService() {
+    if (const_1.IS_WINDOWS)
+        return getWindowsServicePids().then(x => x[node_process_1.pid] || x[node_process_1.ppid]);
+    if (process.platform === 'linux') {
+        // interactive shells live in session-*.scope; only a leaf *.service means this process is actually inside a service unit
+        const systemdFromCgroup = await (0, promises_1.readFile)('/proc/self/cgroup', 'utf8').then(cgroup => cgroup.split('\n')
+            // cgroup v1 uses single-colon fields while v2 uses double-colon; taking the last colon-separated field covers both
+            .map(line => line.split(':').pop()?.split('/').pop() || '')
+            .find(unit => unit.endsWith('.service')));
+        if (systemdFromCgroup)
+            return systemdFromCgroup;
+        // keep env markers as a last fallback only for non-interactive runs, to avoid false positives in normal terminal sessions
+        if (!process.stdin.isTTY && !process.stdout.isTTY && (process.env.INVOCATION_ID || process.env.JOURNAL_STREAM || process.env.NOTIFY_SOCKET || process.env.SYSTEMD_EXEC_PID))
+            return process.env.INVOCATION_ID || process.env.SYSTEMD_EXEC_PID || 'systemd';
+        return false;
+    }
+    // launchd services expose LAUNCH_JOB_NAME and run detached from interactive ttys
+    if (!const_1.IS_MAC || process.stdin.isTTY || process.stdout.isTTY)
+        return false;
+    const launchdService = process.env.LAUNCH_JOB_NAME || false;
+    if (launchdService)
+        return launchdService;
+    return false;
+}
 function reg(...pars) {
     return (0, util_1.promisify)(child_process_1.execFile)('reg', pars).then(x => x.stdout);
 }

package/src/vfs.js

@@ -92,7 +92,8 @@ async function applyParentToChild(child, parent, name) {
     inheritFromParent(ret);
     return ret;
 }
-async function urlToNode(url, ctx, parent = exports.vfs, resolveMissing) {
+async function urlToNode(url, ctx, parent = exports.vfs, allowMissing // true means missing path segments still resolve to temporary nodes with a computed source path
+) {
     let initialSlashes = 0;
     while (url[initialSlashes] === '/')
         initialSlashes++;
@@ -105,25 +106,16 @@ async function urlToNode(url, ctx, parent = exports.vfs, resolveMissing) {
         return;
     const hasTrailingSlash = url.endsWith('/');
     const rest = nextSlash < 0 ? '' : url.slice(nextSlash + 1, hasTrailingSlash ? -1 : undefined);
-    const allowMissing = resolveMissing === true;
     const assumeFolder = allowMissing && (rest > '' || hasTrailingSlash);
     const ret = await getNodeByName(name, parent, assumeFolder);
     if (!ret)
         return;
     if (rest || ret?.original)
-        return urlToNode(rest, ctx, ret, resolveMissing);
+        return urlToNode(rest, ctx, ret, allowMissing);
     if (ret.source)
-        if (!showHiddenFiles.get() && await isHiddenFile(ret.source))
+        if (!showHiddenFiles.get() && await isHiddenFile(ret.source)
+            || !allowMissing && await setIsFolder(ret) === undefined) // undefined = not found on disk
             return;
-        else if (await setIsFolder(ret) === undefined) { // undefined = not found on disk
-            if (!resolveMissing)
-                return;
-            if (allowMissing)
-                return ret;
-            const rest = ret.source.slice(parent.source.length); // we know parent has .source, otherwise !ret.source || ret.original
-            resolveMissing((0, misc_1.removeStarting)('/', rest));
-            return parent;
-        }
     return ret;
 }
 async function nodeStats(node) {

package/src/webdav.js

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handledWebdav = handledWebdav;
+exports.webdav = void 0;
+exports.releaseWebdavLock = releaseWebdavLock;
 const consumers_1 = require("node:stream/consumers");
 const vfs_1 = require("./vfs");
 const cross_1 = require("./cross");
@@ -33,13 +34,26 @@ const LOCK_MAX_SECONDS = cross_1.DAY / 1000;
 const xmlParser = new fast_xml_parser_1.XMLParser({ ignoreAttributes: false, removeNSPrefix: true, trimValues: true });
 const canOverwrite = new Set();
 const locks = new Map();
-function isLocked(path, ctx) {
+function releaseWebdavLock(path) {
     const lock = locks.get(path);
     if (!lock)
         return false;
+    clearTimeout(lock.timeout);
+    locks.delete(path);
+    return true;
+}
+async function isLocked(path, ctx) {
+    const lock = locks.get(path);
+    if (!lock)
+        return false;
+    // if the resource is gone, keeping the lock only creates fake 423 responses
+    if (!await (0, vfs_1.urlToNode)(path, ctx)) {
+        releaseWebdavLock(path);
+        return false;
+    }
     const ifHeader = ctx.get('If');
     const tokenHeader = ctx.get(TOKEN_HEADER);
-    if (hasToken(ifHeader, lock.token) || hasToken(tokenHeader, lock.token))
+    if (isSameLockPrincipal(lock, ctx) && (hasToken(ifHeader, lock.token) || hasToken(tokenHeader, lock.token)))
         return false;
     ctx.status = cross_1.HTTP_LOCKED;
     return true;
@@ -49,7 +63,13 @@ function hasToken(header, token) {
         return false;
     return header.includes(`<${token}>`) || header.split(/[,;\s]+/).includes(token);
 }
-async function handledWebdav(ctx) {
+function getWebdavPrincipal(ctx) {
+    return (0, auth_1.getCurrentUsername)(ctx) || '';
+}
+function isSameLockPrincipal(lock, ctx) {
+    return lock.principal === getWebdavPrincipal(ctx);
+}
+const webdav = async (ctx, next) => {
     let { path } = ctx;
     path = path.replace(/^\/+/, '/'); // double-slash is causing empty listing in filezilla-pro
     const ua = ctx.get('user-agent');
@@ -61,25 +81,26 @@ async function handledWebdav(ctx) {
     if (isWebdavAuthRequest && ua && (0, auth_1.getCurrentUsername)(ctx))
         webdavDetectedAgents.try(webdavAgentKey(ctx, ua), () => true);
     if (ctx.method === 'OPTIONS') {
-        if (ctx.get('Access-Control-Request-Method'))
-            return; // it's a preflight cors request, not webdav
+        if (ctx.get('Access-Control-Request-Method')) // it's a preflight cors request, not webdav
+            return next();
         setWebdavHeaders();
         ctx.body = '';
-        return true;
+        return;
     }
     if (isWebdavAuthRequest && shouldChallengeWebdav())
-        return true;
+        return;
     if (ctx.method === 'PUT') {
-        if (isLocked(path, ctx))
-            return true;
+        if (await isLocked(path, ctx))
+            return;
+        const overwriteGraceKey = path + (0, cross_1.prefix)('|', (0, auth_1.getCurrentUsername)(ctx)); // bind temporary overwrite grace to the authenticated user so accounts cannot reuse each other's grace window
         // Finder first creates an empty file (a test?) then wants to overwrite it, which requires deletion permission, but the user may not have it, causing a renamed upload. To solve, so we give it special permission for a few seconds.
         const x = ctx.get('x-expected-entity-length'); // field used by Finder's webdav on actual upload, after
         if (!x && !ctx.length) {
-            canOverwrite.add(path);
-            setTimeout(() => canOverwrite.delete(path), 10_000); // grace period
+            canOverwrite.add(overwriteGraceKey);
+            setTimeout(() => canOverwrite.delete(overwriteGraceKey), 10_000); // grace period
         }
-        else if (canOverwrite.has(path)) {
-            canOverwrite.delete(path);
+        else if (canOverwrite.has(overwriteGraceKey)) {
+            canOverwrite.delete(overwriteGraceKey);
             const node = await (0, vfs_1.urlToNode)(path, ctx);
             if (node?.source)
                 await (0, promises_1.rm)(node.source).catch(() => { });
@@ -88,25 +109,27 @@ async function handledWebdav(ctx) {
             ctx.req.headers['content-length'] = x;
         if (KNOWN_UA.test(ua) || webdavDetectedAgents.has(webdavAgentKey(ctx, ua)))
             ctx.query.existing ??= 'overwrite'; // with webdav this is our default
-        return; // default handling
+        return next();
     }
     if (ctx.method === 'MKCOL') {
         setWebdavHeaders();
-        if (isLocked(path, ctx))
-            return true;
+        if (await isLocked(path, ctx))
+            return;
         const node = await (0, vfs_1.urlToNode)(path, ctx);
-        if (node)
-            return ctx.status = cross_1.HTTP_METHOD_NOT_ALLOWED;
-        let name = '';
-        const parentNode = await (0, vfs_1.urlToNode)(path, ctx, vfs_1.vfs, v => name = v);
-        if (!parentNode)
-            return ctx.status = cross_1.HTTP_NOT_FOUND;
+        if (node) {
+            ctx.status = cross_1.HTTP_METHOD_NOT_ALLOWED;
+            return;
+        }
+        const parentNode = await (0, vfs_1.urlToNode)((0, path_1.dirname)(path), ctx);
+        if (!parentNode) // this is a bit incoherent with the way we handle PUT, which doesn't stop in this case, but it's by RFC 4918 section 9.3
+            return ctx.status = cross_1.HTTP_CONFLICT;
+        const name = (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(path), '');
         if (!(0, misc_1.isValidFileName)(name))
             return ctx.status = cross_1.HTTP_BAD_REQUEST;
         if ((0, vfs_1.statusCodeForMissingPerm)(parentNode, 'can_upload', ctx)) {
             if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
                 setWebdavHeaders(true);
-            return true;
+            return;
         }
         try {
             await (0, promises_1.mkdir)((0, path_1.join)(parentNode.source, name));
@@ -118,21 +141,26 @@ async function handledWebdav(ctx) {
     }
     if (ctx.method === 'MOVE') {
         setWebdavHeaders();
-        if (isLocked(path, ctx))
-            return true;
+        if (await isLocked(path, ctx))
+            return;
         const node = await (0, vfs_1.urlToNode)(path, ctx);
         if (!node)
-            return;
+            return next();
         let dest = ctx.get('destination');
         const i = dest.indexOf('//');
         if (i >= 0)
             dest = dest.slice(dest.indexOf('/', i + 2));
         dest = (0, cross_1.join)(ctx.state.root || '', dest); // on Windows, we must use / as the delimiter to be able to compare with `path` below
-        if (isLocked(dest, ctx))
-            return true;
+        if (await isLocked(dest, ctx))
+            return;
         if ((0, path_1.dirname)(path) === (0, path_1.dirname)(dest)) // rename case. `path` is is encoded, so we test before decoding `dest`
             try {
-                await (0, frontEndApis_1.requestedRename)(node, (0, path_1.basename)(decodeURI(dest)), ctx);
+                // decode the single path segment so reserved chars like %2C become their real name on rename
+                const newName = (0, cross_1.safeDecodeURIComponent)((0, path_1.basename)(dest), '');
+                if (!newName)
+                    return ctx.status = cross_1.HTTP_BAD_REQUEST;
+                await (0, frontEndApis_1.requestedRename)(node, newName, ctx);
+                releaseWebdavLock(path); // RFC 4918 says MOVE must not carry locks to destination, so clear source lock on success
                 return ctx.status = cross_1.HTTP_CREATED;
             }
             catch (e) {
@@ -142,13 +170,18 @@ async function handledWebdav(ctx) {
         if (moveRes instanceof Error)
             return ctx.status = moveRes.status || cross_1.HTTP_SERVER_ERROR;
         const err = moveRes?.errors?.[0];
+        if (!err)
+            releaseWebdavLock(path); // successful MOVE leaves the old path invalid, therefore its lock must be dropped
         return ctx.status = !err ? cross_1.HTTP_CREATED : typeof err === 'number' ? err : cross_1.HTTP_SERVER_ERROR;
     }
     if (ctx.method === 'DELETE') {
         setWebdavHeaders();
-        if (isLocked(path, ctx))
-            return true;
-        return; // allow default handling in serveGuiAndSharedFiles.ts
+        if (await isLocked(path, ctx))
+            return;
+        await next();
+        if (ctx.status === cross_1.HTTP_OK)
+            releaseWebdavLock(path); // webdav clients may forget UNLOCK; successful delete must clear any lock
+        return;
     }
     if (ctx.method === 'UNLOCK') {
         setWebdavHeaders();
@@ -156,8 +189,10 @@ async function handledWebdav(ctx) {
         const lock = locks.get(path);
         if (x !== lock?.token)
             return ctx.status = cross_1.HTTP_BAD_REQUEST;
-        clearTimeout(lock.timeout);
-        locks.delete(path);
+        // with force_webdav_login disabled a client may silently fall back to anonymous; keep lock ownership on the original principal
+        if (!isSameLockPrincipal(lock, ctx))
+            return ctx.status = cross_1.HTTP_PRECONDITION_FAILED;
+        releaseWebdavLock(path);
         ctx.set(TOKEN_HEADER, x);
         if (const_1.IS_MAC)
             (0, vfs_1.urlToNode)(path, ctx).then(x => x?.source && dotClean((0, path_1.dirname)(x.source)));
@@ -176,14 +211,17 @@ async function handledWebdav(ctx) {
             const lock = locks.get(path);
             if (token !== lock?.token)
                 return ctx.status = cross_1.HTTP_PRECONDITION_FAILED;
+            // same-token refresh from another principal would make abandoned locks effectively persistent
+            if (!isSameLockPrincipal(lock, ctx))
+                return ctx.status = cross_1.HTTP_PRECONDITION_FAILED;
             // refresh lock – keep the same token on refresh so clients can continue using the lock they already hold
             clearTimeout(lock.timeout);
-            lock.timeout = setTimeout(() => locks.delete(path), seconds * 1000);
+            lock.timeout = setTimeout(() => releaseWebdavLock(path), seconds * 1000);
             lock.seconds = seconds;
             locks.set(path, lock);
             ctx.set(TOKEN_HEADER, lock.token);
             ctx.body = renderLockResponse(lock.token, lock.seconds);
-            return true;
+            return;
         }
         const lockinfo = (0, cross_1.try_)(() => xmlParser.parse(body).lockinfo);
         const scope = lodash_1.default.keys(lockinfo?.lockscope)[0];
@@ -197,11 +235,11 @@ async function handledWebdav(ctx) {
         if (locks.has(path))
             return ctx.status = cross_1.HTTP_LOCKED;
         const newToken = 'urn:uuid:' + (0, node_crypto_1.randomUUID)();
-        const timeout = setTimeout(() => locks.delete(path), seconds * 1000);
-        locks.set(path, { token: newToken, timeout, seconds });
+        const timeout = setTimeout(() => releaseWebdavLock(path), seconds * 1000);
+        locks.set(path, { token: newToken, timeout, seconds, principal: getWebdavPrincipal(ctx) });
         ctx.set(TOKEN_HEADER, newToken);
         ctx.body = renderLockResponse(newToken, seconds);
-        return true;
+        return;
         function getProvidedLockToken(ctx) {
             const direct = ctx.get(TOKEN_HEADER).replace(/[<>]/g, '');
             if (direct)
@@ -213,8 +251,8 @@ async function handledWebdav(ctx) {
             return `<?xml version="1.0" encoding="utf-8"?><prop xmlns="DAV:"><lockdiscovery><activelock>
                 <locktype><write/></locktype>
                 <lockscope><exclusive/></lockscope>
-                <locktoken><href>${token}</href></locktoken>
-                <lockroot><href>${path}</href></lockroot>
+                <locktoken><href>${lodash_1.default.escape(token)}</href></locktoken>
+                <lockroot><href>${lodash_1.default.escape(path)}</href></lockroot>
                 <depth>0</depth>
                 <timeout>Second-${seconds}</timeout>
             </activelock></lockdiscovery></prop>`;
@@ -224,14 +262,14 @@ async function handledWebdav(ctx) {
         setWebdavHeaders();
         const node = await (0, vfs_1.urlToNode)(path, ctx);
         if (!node)
-            return;
+            return next();
         let depth = Number(ctx.get('depth'));
         depth = isNaN(depth) ? Infinity : depth;
         const isList = depth !== 0;
         if ((0, vfs_1.statusCodeForMissingPerm)(node, isList ? 'can_list' : 'can_see', ctx)) {
             if (ctx.status === cross_1.HTTP_UNAUTHORIZED)
                 setWebdavHeaders(true);
-            return true;
+            return;
         }
         ctx.type = 'xml';
         ctx.status = 207;
@@ -246,7 +284,7 @@ async function handledWebdav(ctx) {
         }
         res.write(`</multistatus>`);
         res.end();
-        return true;
+        return;
         async function sendEntry(node, append = false) {
             if ((0, vfs_1.nodeIsLink)(node))
                 return;
@@ -254,7 +292,7 @@ async function handledWebdav(ctx) {
             const isDir = await (0, vfs_1.nodeIsFolder)(node);
             const st = await (0, vfs_1.nodeStats)(node);
             res.write(`<response>
-              <href>${outPath + (append ? (0, cross_1.pathEncode)(name, true) + (isDir ? '/' : '') : '')}</href>
+              <href>${lodash_1.default.escape(outPath + (append ? (0, cross_1.pathEncode)(name, true) + (isDir ? '/' : '') : ''))}</href>
               <propstat>
                 <status>HTTP/1.1 200 OK</status>
                 <prop>
@@ -272,6 +310,7 @@ async function handledWebdav(ctx) {
         setWebdavHeaders();
         return ctx.status = cross_1.HTTP_METHOD_NOT_ALLOWED;
     }
+    return next();
     function setWebdavHeaders(authenticate = false) {
         ctx.set('DAV', '1,2');
         ctx.set('MS-Author-Via', 'DAV');
@@ -300,7 +339,8 @@ async function handledWebdav(ctx) {
             return true;
         }
     }
-}
+};
+exports.webdav = webdav;
 function compileWebdavAgentRegex(v) {
     return !v ? null : v === true ? /.*/ : new RegExp(v.trim(), 'i');
 }