nextcloud/server · warning · Sabre\DAV\Exception\MethodNotAllowed

No permission to list folder contents

Error message

No permission to list folder contents

What it means

EntityTypeCollection deliberately refuses to enumerate its children: PROPFIND or GET on the entity-type level (/remote.php/dav/comments/files) always throws MethodNotAllowed, HTTP 405. Comment collections can only be addressed per concrete object id; there is no way to list 'all commented objects'.

Source

Thrown at apps/dav/lib/Comments/EntityTypeCollection.php:80

		return new EntityCollection(
			$name,
			$this->name,
			$this->commentsManager,
			$this->userManager,
			$this->userSession,
			$this->logger
		);
	}

	/**
	 * Returns an array with all the child nodes
	 *
	 * @return \Sabre\DAV\INode[]
	 * @throws MethodNotAllowed
	 */
	#[\Override]
	public function getChildren() {
		throw new MethodNotAllowed('No permission to list folder contents');
	}

	/**
	 * Checks if a child-node with the specified name exists
	 *
	 * @param string $name
	 * @return bool
	 */
	#[\Override]
	public function childExists($name) {
		return call_user_func($this->childExistsFunction, $name);
	}
}

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Always include the object id segment: /dav/comments/files/<fileId>.
2. Discover object ids from their own APIs (e.g. the files tree), never from the comments tree.
3. Configure WebDAV browsers to skip expansion below /dav/comments/<entityType>.

Example fix

// before: HTTP 405 No permission to list folder contents
$client->propfind('/remote.php/dav/comments/files/', [], 1);

// after: address one object's collection
$client->propfind('/remote.php/dav/comments/files/' . $fileId . '/', [], 1);

// never target the entity-type level; always the object level
$commentsUrl = '/remote.php/dav/comments/files/' . $fileId . '/';
$client->propfind($commentsUrl, [], 1);

When it happens

Trigger: PROPFIND with Depth 1 on /remote.php/dav/comments/files/ (or any other entity-type collection) expecting a list of object collections; GET on the same URL; generic WebDAV browsers recursively expanding the comments tree.

Common situations: Generic WebDAV clients (Cyberduck, rclone-style tools) walking the whole DAV tree; scripts trying to discover all comment threads; users expecting a browsable comment index.

Related errors

• Invalid actor "$actorType"
• The resource you tried to create has a reserved name
• Only authors are allowed to edit their comment.
• Message exceeds allowed character limit of 1000
• Invalid input values

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/73b4390b65888592. Report an issue: GitHub.