fix: fail uploads when uri does not match session

This is a cosmetic change that can cause false security reports: the
current implementation of the upload root collection returns UploadHome
in every case, based on the current session, either the one of the
logged in user, or for the share. The former allows uploading files in
what looks like the upload folder of another user, but is in reality the
one of the logged in user. Those requests will now fail with a 403
instead.

Signed-off-by: Salvatore Martire <4652631+salmart-dev@users.noreply.github.com>

Author: salmart-dev

apps/dav/lib/Upload/RootCollection.php

@@ -12,7 +12,10 @@
 
 use OCP\Files\IRootFolder;
 use OCP\IUserSession;
+use OCP\Server;
 use OCP\Share\IManager;
+use Sabre\DAV\Exception\Forbidden;
+use Sabre\DAV\INode;
 use Sabre\DAVACL\AbstractPrincipalCollection;
 use Sabre\DAVACL\PrincipalBackend;
 
@@ -34,7 +37,14 @@ public function __construct(
 	 * @inheritdoc
 	 */
 	#[\Override]
-	public function getChildForPrincipal(array $principalInfo): UploadHome {
+	public function getChildForPrincipal(array $principalInfo): INode|UploadHome {
+		[$prefix, $name] = \Sabre\Uri\split($principalInfo['uri']);
+		$user = Server::get(IUserSession::class)->getUser();
+		if ($prefix !== 'principals/shares' && $user?->getUID() !== $name) {
+			// if the request is not using a share token and the URL does not match the user, error out
+			throw new Forbidden('Not allowed');
+		}
+
 		return new UploadHome(
 			$principalInfo,
 			$this->cleanupService,