WebDAV: Fix ACL validation for target folders.

CHANGELOG.md

@@ -17,6 +17,7 @@ This version includes **multiple breaking changes**. If you are upgrading from v
   - Invalid `receivedAt` headers after importing (#2939).
   - Sorting order issues when emails lack `receivedAt` headers.
 - IMAP: Fix `BINARY` fetch responses (#2940).
+- WebDAV: Fix ACL validation for target folders.
 - ACME: Allow requesting apex domain certificates.
 - Hostname issues: 
   - Accept RFC 6761 reserved TLDs during bootstrap.

crates/dav/src/file/copy_move.rs

@@ -160,7 +160,7 @@ impl FileCopyMoveRequestHandler for Server {
         if let Some(document_id) = destination.document_id {
             if let Some(delete_destination) = &delete_destination
                 && !access_token.is_member(to_account_id)
-                && !from_resources.has_access_to_container(
+                && !to_resources.has_access_to_container(
                     access_token,
                     delete_destination.document_id.unwrap(),
                     Acl::Delete,
@@ -170,7 +170,7 @@ impl FileCopyMoveRequestHandler for Server {
             }
 
             if !access_token.is_member(to_account_id)
-                && !from_resources.has_access_to_container(access_token, document_id, Acl::Modify)
+                && !to_resources.has_access_to_container(access_token, document_id, Acl::Modify)
             {
                 return Err(DavError::Code(StatusCode::FORBIDDEN));
             }

crates/store/src/build/registry.rs

@@ -306,6 +306,13 @@ impl RegistryStore {
         inner
     }
 
+    #[cfg(feature = "test_mode")]
+    pub fn clone_with_port(&self, store: u16) -> Self {
+        let mut inner = self.0.as_ref().clone();
+        inner.env_https_port = Some(store);
+        Self(inner.into())
+    }
+
     #[cfg(feature = "test_mode")]
     pub async fn new(
         path: &str,

tests/src/utils/server.rs

@@ -311,6 +311,12 @@ impl TestServerBuilder {
         let mut servers = Listeners::parse(&mut self.bootstrap).await;
         servers.bind_and_drop_priv(&mut self.bootstrap);
 
+        // Set HTTP port
+        self.bootstrap.registry = self
+            .bootstrap
+            .registry
+            .clone_with_port(self.http_listener_port);
+
         if init_store {
             // Add safe defaults if missing
             self.bootstrap.insert_safe_defaults().await;