Understanding WebDAV Upload Permissions

Issue

• Are documents uploaded through WebDAV given more permissions than UI uploads?
• Why can one user who uploads a document through WebDAV update or delete the file while another user with the same level of permissions cannot?

Environment

• DXP 7.0
• DXP 7.1

Resolution

• When the first user uploaded the document themselves, they were also granted the "Owner" role of that document in addition to any assigned roles, giving them the expected default permissions to Update, Delete, and change Permissions for that document (in addition to the View and Add Discussion default permissions granted to site members).
• The difference in behavior between the user who uploaded the document (being able to interact with a document) and a second user (not being able to update/delete that document by default) is because role permissions are cumulative. In the example above, the first user is both a site member and owner (regarding the uploaded document), while the second user is only a site member.
• Using the file manager via WebDAV does not bypass the functionality of the web interface -- uploads from the UI and from WebDAV are treated the same within Liferay regarding each user's roles and permissions.

Additional Information

• If desired, you can change the enabled Owner permissions of an uploaded document using the instructions found here.
• More information about WebDAV can be found in this Help Center article, and additional information about restricting Documents and Media permissions can be found here.
• Please note, there is a known issue where documents uploaded via WebDAV include two extra permissions for guests (the View and Add Discussion permissions, unlike documents uploaded through the UI). A fix for this issue for DXP 7.0 and 7.1 can be requested through Liferay Support by referencing LPS-89281.