{"record":{"id":"73b4390b65888592","repo":"nextcloud/server","slug":"no-permission-to-list-folder-contents","errorCode":null,"errorMessage":"No permission to list folder contents","messagePattern":"No permission to list folder contents","errorType":"http","errorClass":"Sabre\\DAV\\Exception\\MethodNotAllowed","httpStatus":405,"severity":"warning","filePath":"apps/dav/lib/Comments/EntityTypeCollection.php","lineNumber":80,"sourceCode":"\t\treturn new EntityCollection(\n\t\t\t$name,\n\t\t\t$this->name,\n\t\t\t$this->commentsManager,\n\t\t\t$this->userManager,\n\t\t\t$this->userSession,\n\t\t\t$this->logger\n\t\t);\n\t}\n\n\t/**\n\t * Returns an array with all the child nodes\n\t *\n\t * @return \\Sabre\\DAV\\INode[]\n\t * @throws MethodNotAllowed\n\t */\n\t#[\\Override]\n\tpublic function getChildren() {\n\t\tthrow new MethodNotAllowed('No permission to list folder contents');\n\t}\n\n\t/**\n\t * Checks if a child-node with the specified name exists\n\t *\n\t * @param string $name\n\t * @return bool\n\t */\n\t#[\\Override]\n\tpublic function childExists($name) {\n\t\treturn call_user_func($this->childExistsFunction, $name);\n\t}\n}\n","sourceCodeStart":62,"sourceCodeEnd":94,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Comments/EntityTypeCollection.php#L62-L94","documentation":"EntityTypeCollection deliberately refuses to enumerate its children: PROPFIND or GET on the entity-type level (/remote.php/dav/comments/files) always throws MethodNotAllowed, HTTP 405. Comment collections can only be addressed per concrete object id; there is no way to list 'all commented objects'.","triggerScenarios":"PROPFIND with Depth 1 on /remote.php/dav/comments/files/ (or any other entity-type collection) expecting a list of object collections; GET on the same URL; generic WebDAV browsers recursively expanding the comments tree.","commonSituations":"Generic WebDAV clients (Cyberduck, rclone-style tools) walking the whole DAV tree; scripts trying to discover all comment threads; users expecting a browsable comment index.","solutions":["Always include the object id segment: /dav/comments/files/<fileId>.","Discover object ids from their own APIs (e.g. the files tree), never from the comments tree.","Configure WebDAV browsers to skip expansion below /dav/comments/<entityType>."],"exampleFix":"// before: HTTP 405 No permission to list folder contents\n$client->propfind('/remote.php/dav/comments/files/', [], 1);\n\n// after: address one object's collection\n$client->propfind('/remote.php/dav/comments/files/' . $fileId . '/', [], 1);","handlingStrategy":"validation","validationCode":"// never target the entity-type level; always the object level\n$commentsUrl = '/remote.php/dav/comments/files/' . $fileId . '/';\n$client->propfind($commentsUrl, [], 1);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never PROPFIND /dav/comments/<entityType> itself — only /dav/comments/<entityType>/<objectId>.","Discover object ids from their own APIs, not from the comments tree.","Keep recursive WebDAV browsers out of the comments subtree."],"tags":["dav","comments","webdav","method-not-allowed"],"backgroundTag":"method-not-allowed","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}