{"record":{"id":"29e32b4cb85ed326","repo":"nextcloud/server","slug":"permission-denied-to-delete-this-collection","errorCode":null,"errorMessage":"Permission denied to delete this collection","messagePattern":"Permission denied to delete this collection","errorType":"exception","errorClass":"Sabre\\DAV\\Exception\\Forbidden","httpStatus":403,"severity":"warning","filePath":"apps/dav/lib/Comments/RootCollection.php","lineNumber":144,"sourceCode":"\t *\n\t * @param string $name\n\t * @return bool\n\t */\n\t#[\\Override]\n\tpublic function childExists($name) {\n\t\t$this->initCollections();\n\t\tassert(!is_null($this->entityTypeCollections));\n\t\treturn isset($this->entityTypeCollections[$name]);\n\t}\n\n\t/**\n\t * Deleted the current node\n\t *\n\t * @throws Forbidden\n\t */\n\t#[\\Override]\n\tpublic function delete() {\n\t\tthrow new Forbidden('Permission denied to delete this collection');\n\t}\n\n\t/**\n\t * Returns the name of the node.\n\t *\n\t * This is used to generate the url.\n\t *\n\t * @return string\n\t */\n\t#[\\Override]\n\tpublic function getName() {\n\t\treturn $this->name;\n\t}\n\n\t/**\n\t * Renames the node\n\t *\n\t * @param string $name The new name","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Comments/RootCollection.php#L126-L162","documentation":"RootCollection::delete() refuses DELETE on the comments root collection with Forbidden (HTTP 403). Bulk deletion of the whole comment tree is not exposed over DAV; only individual comment nodes may be deleted.","triggerScenarios":"DELETE /remote.php/dav/comments targeting the root collection; cleanup scripts or recursive WebDAV deleters that remove parent collections after emptying children.","commonSituations":"Data-cleanup scripts trying to wipe all comments; WebDAV clients that recurse delete; admins attempting GDPR-style purges over the DAV API.","solutions":["Delete comments individually: DELETE on the comment node under /dav/comments/<type>/<objectId>/<commentId>.","Use occ commands or the server-side CommentsManager for bulk operations.","Adjust cleanup scripts to never issue DELETE on collection nodes."],"exampleFix":"// before: HTTP 403 Permission denied to delete this collection\n$client->request('DELETE', '/remote.php/dav/comments');\n\n// after: delete single comments\nforeach ($commentIds as $id) {\n    $client->request('DELETE', '/remote.php/dav/comments/files/123/' . $id);\n}","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Delete comments individually via DELETE on the comment node.","Use occ or the server-side CommentsManager for bulk cleanup.","Scripted cleanups must skip collection-level DELETE requests."],"tags":["dav","comments","delete","forbidden"],"backgroundTag":"permission-denied","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}