RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

WebDAV Integration Not Allowed

What it means

getWebdavFileList throws error-not-allowed ('WebDAV Integration Not Allowed') when the Webdav_Integration_Enabled setting is false. The toggle is checked right after the user check, so directory listing is blocked workspace-wide even for users with previously linked accounts. This mirrors the same gate used by the add-account and download methods.

Source

Thrown at apps/meteor/server/bridges/webdav/methods/getWebdavFileList.ts:26

import { WebdavClientAdapter } from '../lib/webdavClientAdapter';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		getWebdavFileList(accountId: IWebdavAccount['_id'], path: string): { success: boolean; data: IWebdavNode[] };
	}
}

Meteor.methods<ServerMethods>({
	async getWebdavFileList(accountId, path) {
		const userId = Meteor.userId();

		if (!userId) {
			throw new Meteor.Error('error-invalid-user', 'Invalid User', { method: 'getWebdavFileList' });
		}

		if (!settings.get('Webdav_Integration_Enabled')) {
			throw new Meteor.Error('error-not-allowed', 'WebDAV Integration Not Allowed', {
				method: 'getWebdavFileList',
			});
		}

		const account = await WebdavAccounts.findOneByIdAndUserId(accountId, userId, {});
		if (!account) {
			throw new Meteor.Error('error-invalid-account', 'Invalid WebDAV Account', {
				method: 'getWebdavFileList',
			});
		}

		try {
			const cred = getWebdavCredentials(account);
			const client = new WebdavClientAdapter(account.serverURL, cred);
			const data = (await client.getDirectoryContents(path)) as IWebdavNode[];
			return { success: true, data };
		} catch (error) {
			throw new Meteor.Error('could-not-access-webdav', 'Could not access webdav', {

View on GitHub (pinned to b2c16d5842)

Solutions

  1. Enable WebDAV Integration under Admin → WebDAV Integration
  2. Hide the WebDAV browser UI when the integration is off
  3. Scripts should verify the setting before listing files

Example fix

// before
await call('getWebdavFileList', accountId, path); // throws error-not-allowed

// after
const { value } = await (await fetch('/api/v1/settings/Webdav_Integration_Enabled', { headers })).json();
if (value !== true) throw new Error('WebDAV Integration is disabled');
await call('getWebdavFileList', accountId, path);
Defensive patterns

Strategy: validation

Validate before calling

const { value } = await (await fetch('/api/v1/settings/Webdav_Integration_Enabled', { headers: adminHeaders })).json();
if (value !== true) throw new Error('WebDAV Integration is disabled');
await call('getWebdavFileList', accountId, path);

Try / catch

try {
  await Meteor.callAsync('getWebdavFileList', accountId, path);
} catch (e) {
  if (e.error === 'error-not-allowed') {
    // integration off: do not mount the WebDAV browser at all
  }
}

Prevention

When it happens

Trigger: Calling getWebdavFileList while Webdav_Integration_Enabled is false or unset — the admin disabled the integration, or it was never enabled on this deployment.

Common situations: Opening a WebDAV file picker after the integration was turned off; environments where the setting was lost in a restore/migration; scripts running against workspaces where WebDAV is not configured.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/3df8a321f9a6cf22. Report an issue: GitHub.