add parentcheck

Signed-off-by: Christian Richter <crichter@owncloud.com>

internal/http/services/owncloud/ocdav/copy.go

@@ -559,6 +559,26 @@ func (s *svc) prepareCopy(ctx context.Context, w http.ResponseWriter, r *http.Re
 		return nil
 	}
 
+	isParent, err := s.referenceIsChildOf(ctx, s.gatewaySelector, srcRef, dstRef)
+	if err != nil {
+		switch err.(type) {
+		case errtypes.IsNotSupported:
+			log.Error().Err(err).Msg("can not detect recursive copy operation. missing machine auth configuration?")
+			w.WriteHeader(http.StatusForbidden)
+		default:
+			log.Error().Err(err).Msg("error while trying to detect recursive copy operation")
+			w.WriteHeader(http.StatusInternalServerError)
+		}
+	}
+
+	if isParent {
+		w.WriteHeader(http.StatusConflict)
+		b, err := errors.Marshal(http.StatusBadRequest, "can not copy a folder into one of its parents", "")
+		errors.HandleWebdavError(log, w, b, err)
+		return nil
+
+	}
+
 	oh := r.Header.Get(net.HeaderOverwrite)
 	overwrite, err := net.ParseOverwrite(oh)
 	if err != nil {