webdav: only require locks when necessary

[klarose]

The WebDAV RFC is pretty clear that if the source and destination of a MOVE request are locked, then the request must include lock tokens for both. It doesn't explicitly state that if only one is locked, the request need only include a token for the one, but that seems fairly obvious: if the destination of an operation is not locked, a client should be able to copy or move a locked resource over top of it, particularly if it doesn't exist in the first place.

Prior to this commit, the lock validation logic required that both the source and destination of an operation hold a lock if any locks were presented. Consequently, binary operations where only one of the resources were locked would always fail. For example, the following sequence of events would fail with a 412 Precondition Failed:

• LOCK /foo
• MOVE /foo (Destination: /bar)

This commit changes the lock validation to only require locks for resources which are actually locked. It takes some care to ensure that invalid lock tokens will cause a failure, even if the resources did not require locks, since both the litmus test and RFC imply that if there are any conditions, and all conditions fail, the request should fail.

Fixes golang/go#43556

[gopherbot]

This PR (HEAD: 15084bca34e06cdc694de1466646021eca08aa49) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/net/+/285754 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off) See the Wiki page for more info

[gopherbot]

This PR (HEAD: 8561cdbc6697cdf2bc30757f2261c6b399f47137) has been imported to Gerrit for code review.

Please visit https://go-review.googlesource.com/c/net/+/285754 to see it.

Tip: You can toggle comments from me using the comments slash command (e.g. /comments off) See the Wiki page for more info