{"record":{"id":"2f3c17c31d0f77e4","repo":"nextcloud/server","slug":"permission-denied-to-create-collections","errorCode":null,"errorMessage":"Permission denied to create collections","messagePattern":"Permission denied to create collections","errorType":"http","errorClass":"Sabre\\DAV\\Exception\\Forbidden","httpStatus":403,"severity":"warning","filePath":"apps/dav/lib/Comments/RootCollection.php","lineNumber":90,"sourceCode":"\t * @param string $name Name of the file\n\t * @param resource|string $data Initial payload\n\t * @return null|string\n\t * @throws Forbidden\n\t */\n\t#[\\Override]\n\tpublic function createFile($name, $data = null) {\n\t\tthrow new Forbidden('Cannot create comments by id');\n\t}\n\n\t/**\n\t * Creates a new subdirectory\n\t *\n\t * @param string $name\n\t * @throws Forbidden\n\t */\n\t#[\\Override]\n\tpublic function createDirectory($name) {\n\t\tthrow new Forbidden('Permission denied to create collections');\n\t}\n\n\t/**\n\t * Returns a specific child node, referenced by its name\n\t *\n\t * This method must throw Sabre\\DAV\\Exception\\NotFound if the node does not\n\t * exist.\n\t *\n\t * @param string $name\n\t * @return \\Sabre\\DAV\\INode\n\t * @throws NotFound\n\t */\n\t#[\\Override]\n\tpublic function getChild($name) {\n\t\t$this->initCollections();\n\t\tif (isset($this->entityTypeCollections[$name])) {\n\t\t\treturn $this->entityTypeCollections[$name];\n\t\t}","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Comments/RootCollection.php#L72-L108","documentation":"RootCollection::createDirectory() refuses MKCOL below the comments root with Forbidden (HTTP 403). The comment tree structure — entity types and per-object collections — is managed by the server and cannot be extended by clients creating collections.","triggerScenarios":"MKCOL /remote.php/dav/comments/<name> attempting to create a custom collection, often as a workaround after receiving a 404 for an unregistered entity type.","commonSituations":"WebDAV clients that auto-create folders before uploading; users manually attempting to 'fix' a missing collection; scripts replicating a folder workflow onto the comments tree.","solutions":["Remove the MKCOL step: collections appear automatically once apps register entity types via CommentsEntityEvent.","For custom commentable objects, register an entity type in a server-side app instead of creating collections over DAV.","Point WebDAV mount and sync tools at the files tree, not the comments tree."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never issue MKCOL under /remote.php/dav/comments — collections appear via registered entity types.","Register custom commentable objects through CommentsEntityEvent in a server app.","Mount generic WebDAV tools on the files tree, not the comments tree."],"tags":["dav","comments","mkcol","forbidden"],"backgroundTag":"permission-denied","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}