{"record":{"id":"d986ea3d00244856","repo":"nextcloud/server","slug":"cannot-create-comments-by-id","errorCode":null,"errorMessage":"Cannot create comments by id","messagePattern":"Cannot create comments by id","errorType":"http","errorClass":"Sabre\\DAV\\Exception\\Forbidden","httpStatus":403,"severity":"warning","filePath":"apps/dav/lib/Comments/RootCollection.php","lineNumber":79,"sourceCode":"\t\t\t\t$this->userManager,\n\t\t\t\t$this->userSession,\n\t\t\t\t$this->logger,\n\t\t\t\t$entityExistsFunction\n\t\t\t);\n\t\t}\n\t}\n\n\t/**\n\t * Creates a new file in the directory\n\t *\n\t * @param string $name Name of the file\n\t * @param resource|string $data Initial payload\n\t * @return null|string\n\t * @throws Forbidden\n\t */\n\t#[\\Override]\n\tpublic function createFile($name, $data = null) {\n\t\tthrow new Forbidden('Cannot create comments by id');\n\t}\n\n\t/**\n\t * Creates a new subdirectory\n\t *\n\t * @param string $name\n\t * @throws Forbidden\n\t */\n\t#[\\Override]\n\tpublic function createDirectory($name) {\n\t\tthrow new Forbidden('Permission denied to create collections');\n\t}\n\n\t/**\n\t * Returns a specific child node, referenced by its name\n\t *\n\t * This method must throw Sabre\\DAV\\Exception\\NotFound if the node does not\n\t * exist.","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/Comments/RootCollection.php#L61-L97","documentation":"RootCollection::createFile() refuses PUT requests whose target's parent collection is the comments root: comments cannot be created at a client-chosen id. Sabre\\DAV\\Exception\\Forbidden maps to HTTP 403. Comment creation is POST-only, and the server assigns the id.","triggerScenarios":"PUT /remote.php/dav/comments/<name> (or any PUT routed to the comments root's createFile) attempting to create or author a comment at a chosen path; generic WebDAV tools that create resources with PUT instead of POST.","commonSituations":"CalDAV/CardDAV-style clients and file-transfer tools that default to PUT; code ported from APIs that allow client-chosen ids; users trying to 'restore' a comment by re-PUTting its old URL.","solutions":["POST the comment JSON payload to the object collection (/dav/comments/files/<fileId>) instead.","Read the assigned comment id from the POST response and use that URL for later GET/PUT/DELETE.","Keep generic WebDAV uploaders away from the comments subtree."],"exampleFix":"// before: HTTP 403 Cannot create comments by id\n$client->request('PUT', '/remote.php/dav/comments/files/123/mycomment', $jsonBody);\n\n// after: POST to the collection; the server assigns the id\n$client->request('POST', '/remote.php/dav/comments/files/123/', $jsonBody);","handlingStrategy":"validation","validationCode":"// create: POST to the object collection — never PUT to a chosen id\n$client->request('POST', '/remote.php/dav/comments/files/123/', $jsonBody);\n// edit afterwards: PUT to the comment node URL returned by the server\n$client->request('PUT', $returnedCommentUrl, $editBody);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use POST for creation on the comments API; ids are server-assigned.","Take comment URLs from POST responses or collection listings.","Do not point generic PUT-based upload tools at /dav/comments."],"tags":["dav","comments","http-method","forbidden"],"backgroundTag":"permission-denied","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}