nextcloud/server · warning · Sabre\DAV\Exception\Forbidden

Cannot create comments by id

Error message

Cannot create comments by id

What it means

RootCollection::createFile() refuses PUT requests whose target's parent collection is the comments root: comments cannot be created at a client-chosen id. Sabre\DAV\Exception\Forbidden maps to HTTP 403. Comment creation is POST-only, and the server assigns the id.

Source

Thrown at apps/dav/lib/Comments/RootCollection.php:79

				$this->userManager,
				$this->userSession,
				$this->logger,
				$entityExistsFunction
			);
		}
	}

	/**
	 * Creates a new file in the directory
	 *
	 * @param string $name Name of the file
	 * @param resource|string $data Initial payload
	 * @return null|string
	 * @throws Forbidden
	 */
	#[\Override]
	public function createFile($name, $data = null) {
		throw new Forbidden('Cannot create comments by id');
	}

	/**
	 * Creates a new subdirectory
	 *
	 * @param string $name
	 * @throws Forbidden
	 */
	#[\Override]
	public function createDirectory($name) {
		throw new Forbidden('Permission denied to create collections');
	}

	/**
	 * Returns a specific child node, referenced by its name
	 *
	 * This method must throw Sabre\DAV\Exception\NotFound if the node does not
	 * exist.

View on GitHub (pinned to ecdeb153ff)

Solutions

1. POST the comment JSON payload to the object collection (/dav/comments/files/<fileId>) instead.
2. Read the assigned comment id from the POST response and use that URL for later GET/PUT/DELETE.
3. Keep generic WebDAV uploaders away from the comments subtree.

Example fix

// before: HTTP 403 Cannot create comments by id
$client->request('PUT', '/remote.php/dav/comments/files/123/mycomment', $jsonBody);

// after: POST to the collection; the server assigns the id
$client->request('POST', '/remote.php/dav/comments/files/123/', $jsonBody);

// create: POST to the object collection — never PUT to a chosen id
$client->request('POST', '/remote.php/dav/comments/files/123/', $jsonBody);
// edit afterwards: PUT to the comment node URL returned by the server
$client->request('PUT', $returnedCommentUrl, $editBody);

When it happens

Trigger: PUT /remote.php/dav/comments/<name> (or any PUT routed to the comments root's createFile) attempting to create or author a comment at a chosen path; generic WebDAV tools that create resources with PUT instead of POST.

Common situations: CalDAV/CardDAV-style clients and file-transfer tools that default to PUT; code ported from APIs that allow client-chosen ids; users trying to 'restore' a comment by re-PUTting its old URL.

Related errors

• Only authors are allowed to edit their comment.
• Permission denied to create collections
• Permission denied to delete this collection
• Permission denied to rename this collection
• VCard object exceeds $cardSizeLimit bytes

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/d986ea3d00244856. Report an issue: GitHub.