Verify User Permissions for New Stricter WebDAV Zip Check

B2C Commerce supports an extension to the WebDAV protocol that allows a client to pack files and folders into a zip archive at the server. With this release, the permission check for creating WebDAV zip archives is stricter.

What: There are two changes to the permission check:

• Previously, the user-required access only to the folders to be zipped. Now, the user must have write permission for the folder where the zip file is created. If the user doesn’t have write permission, the app server responds with a 403 (Forbidden) message.
• Previously, the user could archive /impex/src, including all of its subfolders to a zip file, even if the user didn’t have read permission to some of the subfolders. Now, a permission check occurs for each file and folder the user wants to archive. If the user doesn’t have at least read permission to a subfolder, the subfolder is not part of the zip archive. If the user doesn’t have read permissions to any subfolders, the zip archive is just an empty folder.

  To help you identify if this new stricter permission check affects you, we introduced a new log message to the security logs in Release 20.5. An example of the message is as follows: [2020-03-12 09:11:45.764 GMT] [DW-SEC] User: 'johndoe' (Sites), IP: 136.147.56.1, [UnauthorizedZipAttempt] : No permission to zip [src/subfolder] to [src.zip]. (in IMPEX) 

How: Make sure WebDAV users have write permissions to folders where the WebDAV zip process creates the archive. If necessary, grant the user write permission to /impex/src or use a wildcard to grant the user write permission to WebDAV path /impex/*. Make sure users have read permissions to all folders to be included in zip archives. If necessary, grant users read permission to the folders or use a wildcard to grant read permissions to a folder and all its subfolders.