nextcloud/server · error · Sabre\DAV\Exception\Forbidden

Only authors are allowed to edit their comment.

Error message

Only authors are allowed to edit their comment.

What it means

Sabre\DAV\Exception\Forbidden thrown by CommentNode::checkWriteAccessOnComment() (apps/dav/lib/Comments/CommentNode.php:96). A comment DAV node may only be modified or deleted by its author: the actor type must be 'users', a user must be logged in, and the comment's actorId must equal the session user's UID.

Source

Thrown at apps/dav/lib/Comments/CommentNode.php:96

			// re-used property names are defined as constants
			self::PROPERTY_NAME_MESSAGE,
			self::PROPERTY_NAME_ACTOR_DISPLAYNAME,
			self::PROPERTY_NAME_UNREAD,
			self::PROPERTY_NAME_MENTIONS,
			self::PROPERTY_NAME_MENTION,
			self::PROPERTY_NAME_MENTION_TYPE,
			self::PROPERTY_NAME_MENTION_ID,
			self::PROPERTY_NAME_MENTION_DISPLAYNAME,
		];
	}

	protected function checkWriteAccessOnComment() {
		$user = $this->userSession->getUser();
		if ($this->comment->getActorType() !== 'users'
			|| is_null($user)
			|| $this->comment->getActorId() !== $user->getUID()
		) {
			throw new Forbidden('Only authors are allowed to edit their comment.');
		}
	}

	/**
	 * Deleted the current node
	 *
	 * @return void
	 */
	#[\Override]
	public function delete() {
		$this->checkWriteAccessOnComment();
		$this->commentsManager->delete($this->comment->getId());
	}

	/**
	 * Returns the name of the node.
	 *
	 * This is used to generate the url.

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Authenticate as the user who created the comment before issuing DELETE/PROPPATCH
2. For moderation, use the CommentsManager API / admin tooling, not the DAV comment node
3. If editing your own comment fails, re-check that the request carries the correct authenticated session (not app credentials of a different principal)

Example fix

// before: app tries to delete another user's comment via DAV
$client->request('DELETE', "/remote.php/dav/comments/files/$fileId/$commentId");
// after: only the author path succeeds; others get 403 - handle it
try {
    $client->request('DELETE', "/remote.php/dav/comments/files/$fileId/$commentId");
} catch (Exception\Forbidden $e) { /* not the author: ignore or escalate */ }

$user = $userSession->getUser();
$mayEdit = $user !== null
    && $comment->getActorType() === 'users'
    && $comment->getActorId() === $user->getUID();
if (!$mayEdit) {
    // hide edit affordances instead of letting the request 403
}

function canEditComment(?\OCP\IUser $user, \OCP\Comments\IComment $comment): bool {
    return $user !== null
        && $comment->getActorType() === 'users'
        && $comment->getActorId() === $user->getUID();
}

try {
    $client->request('DELETE', $commentUri);
} catch (\Sabre\DAV\Exception\Forbidden $e) {
    // not the author: surface 'you can only edit your own comments', never retry
}

When it happens

Trigger: DELETE or PROPPATCH on /remote.php/dav/comments/files/<fileId>/<commentId> by a session user that differs from the comment author, by an unauthenticated request, or on a comment authored by a non-user actor (guests, bots with other actor types).

Common situations: Apps or scripts that try to moderate/edit other users' comments over the DAV API; expired sessions during comment edits; attempting to manage system/actor comments.

Related errors

• VCard object exceeds $cardSizeLimit bytes
• Cannot create comments by id
• Permission denied to create collections
• Permission denied to delete this collection
• Permission denied to rename this collection

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/5f62358de8122aee. Report an issue: GitHub.