Allow ajax requests on public webdav interface

[PVince81]

Whenever outgoing shares are disabled, still allow ajax requests to make
it possible to use the Webdav interface in the public link page.

Please note that disabling outgoing shares isn't strong anyway as
someone could abuse the ajax endpoints to access files anyway. To
properly disable remote sharing, public link sharing must be disabled
too.

@oparoz that would also fix the text preview, was it still using Webdav ?

This will be required when the files UI uses Webdav.

Please review @LukasReschke @icewind1991 @MorrisJobke @schiesbn @th3fallen

[PVince81]

Required by #16902 and the text preview #16464

[PVince81]

@LukasReschke @oparoz what do you think ?

[oparoz]

I think it feels strange if core and apps have to use an endpoint located in files_sharing to access public files since it's a completely different URL from the standard one, but at the same times, it makes sense since there is no public page without sharing enabled.

Isn't there a lot of code duplication between the private and public endpoints? That would be my only concern. Apart from that this fix should cover most situations, if it works through proxies and firewalls. 👍

[PVince81]

It would indeed be nice to have the same endpoints for private and public. There was an old idea of creating virtual users for public links but I haven't heard of it since a long time.

[oparoz]

I think this can't happen as long as there isn't a token decoder in core (as opposed to in an app).

[scrutinizer-notifier]

A new inspection was created.

[PVince81]

Rebased

[oparoz]

We need one more vote: @DeepDiver1975 @Xenopathic @nickvergessen

[nickvergessen]

I guess it should have some kind of "same origin" check?

[PVince81]

Usually I think we can't completely block remote access to existing public shares since people can already access them in the web UI, this is only giving them another view. And this also only applies for cases where people mounted the public shares directly but then the admin decided to disable federation afterwards.

@LukasReschke what do you think ?

[MorrisJobke]

@LukasReschke what do you think ?

@LukasReschke ;)

[LukasReschke]

Acceptable.

[MorrisJobke]

This will be required when the files UI uses Webdav.

@PVince81 Do we want to ship this already with 8.2 and then move the files UI to WebDAV in 9.0 but be able to use this on other (federated cloud sharing) 8.2 instances already properly?

cc @nickvergessen @LukasReschke Review please :)

[PVince81]

@MorrisJobke if we only care about files UI with Webdav, 9.0 is fine.
However this fix also helps fixing #16464 but might need additional changes to make the text preview send the proper header.

[LukasReschke]

👍

[PVince81]

Dammit, I set "to release" too early. Still missing a second thumbs up.

[MorrisJobke]

Dammit, I set "to release" too early. Still missing a second thumbs up.

#17601 (comment) ;)

[MorrisJobke]

I'm also fine with this 👍