fix(dav): do not list intermediate upload folders

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

Author: susnux

apps/dav/lib/Upload/RootCollection.php

@@ -26,6 +26,7 @@ public function __construct(
 		private IManager $shareManager,
 	) {
 		parent::__construct($principalBackend, $principalPrefix);
+		$this->disableListing = true;
 	}
 
 	/**

apps/dav/lib/Upload/UploadHome.php

@@ -14,6 +14,7 @@
 use OCP\Files\NotFoundException;
 use OCP\IUserSession;
 use Sabre\DAV\Exception\Forbidden;
+use Sabre\DAV\Exception\MethodNotAllowed;
 use Sabre\DAV\Exception\NotFound;
 use Sabre\DAV\ICollection;
 
@@ -62,14 +63,7 @@ public function getChild($name): UploadFolder {
 	}
 
 	public function getChildren(): array {
-		return array_map(function ($node) {
-			return new UploadFolder(
-				$node,
-				$this->cleanupService,
-				$this->getStorage(),
-				$this->uid,
-			);
-		}, $this->impl()->getChildren());
+		throw new MethodNotAllowed('Listing members of this collection is disabled');
 	}
 
 	public function childExists($name): bool {

build/integration/filesdrop_features/filesdrop.feature

@@ -199,7 +199,7 @@ Scenario: Files drop allow MKCOL without a nickname
     And Downloading public folder "Mallory/folder"
     Then the HTTP status code should be "405"
     And Downloading public file "Mallory/folder/a.txt"
-    Then the HTTP status code should be "405"
+    Then the HTTP status code should be "404"
 
   Scenario: Files drop requires nickname if file request is enabled
     Given user "user0" exists