commented out the WwwAuthenticate header to make webUITests happy

go.mod

@@ -360,7 +360,7 @@ replace github.com/egirna/icap-client => github.com/fschade/icap-client v0.0.0-2
 replace github.com/unrolled/secure => github.com/DeepDiver1975/secure v0.0.0-20240424132259-5b29166734cb
 
 // remove before merge
-replace github.com/cs3org/reva/v2 => github.com/2403905/reva/v2 v2.0.0-20240501145618-dd1c005507a9
+replace github.com/cs3org/reva/v2 => github.com/2403905/reva/v2 v2.0.0-20240502155412-13e7ed59b167
 
 // exclude the v2 line of go-sqlite3 which was released accidentally and prevents pulling in newer versions of go-sqlite3
 // see https://github.com/mattn/go-sqlite3/issues/965 for more details

go.sum

@@ -766,8 +766,8 @@ dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
 git.sr.ht/~sbinet/gg v0.3.1/go.mod h1:KGYtlADtqsqANL9ueOFkWymvzUvLMQllU5Ixo+8v3pc=
-github.com/2403905/reva/v2 v2.0.0-20240501145618-dd1c005507a9 h1:kiJ6yygBqcZkXLNvST7HcPr6i8QOEsk1eTdyiE7drS4=
-github.com/2403905/reva/v2 v2.0.0-20240501145618-dd1c005507a9/go.mod h1:GRUrOp5HbFVwZTgR9bVrMZ/MvVy+Jhxw1PdMmhhKP9E=
+github.com/2403905/reva/v2 v2.0.0-20240502155412-13e7ed59b167 h1:MxDvDI/7HdfLPJEsPcCmGf+q4v72gXgLgw0gn8fvP7I=
+github.com/2403905/reva/v2 v2.0.0-20240502155412-13e7ed59b167/go.mod h1:GRUrOp5HbFVwZTgR9bVrMZ/MvVy+Jhxw1PdMmhhKP9E=
 github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
 github.com/Azure/azure-sdk-for-go v32.4.0+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/azure-storage-blob-go v0.14.0/go.mod h1:SMqIBi+SuiQH32bvyjngEewEeXoPfKMgWlBDaYf6fck=

services/proxy/pkg/middleware/public_share_auth.go

@@ -48,6 +48,8 @@ func isPublicShareAppOpen(r *http.Request) bool {
 		(r.URL.Query().Get(headerShareToken) != "" || r.Header.Get(headerShareToken) != "")
 }
 
+// The public-files requests can also be made in authenticated context. In these cases the OIDCAuthenticator and
+// the BasicAuthenticator needs to ignore the request when the headerShareToken exist.
 func isPublicWithShareToken(r *http.Request) bool {
 	return (strings.HasPrefix(r.URL.Path, "/dav/public-files") || strings.HasPrefix(r.URL.Path, "/remote.php/dav/public-files")) &&
 		(r.URL.Query().Get(headerShareToken) != "" || r.Header.Get(headerShareToken) != "")

vendor/modules.txt

@@ -366,7 +366,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.19.2-0.20240429085656-5faad8dad61e => github.com/2403905/reva/v2 v2.0.0-20240501145618-dd1c005507a9
+# github.com/cs3org/reva/v2 v2.19.2-0.20240429085656-5faad8dad61e => github.com/2403905/reva/v2 v2.0.0-20240502155412-13e7ed59b167
 ## explicit; go 1.21
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime
@@ -2351,4 +2351,4 @@ stash.kopano.io/kgol/rndm
 # github.com/studio-b12/gowebdav => github.com/aduffeck/gowebdav v0.0.0-20231215102054-212d4a4374f6
 # github.com/egirna/icap-client => github.com/fschade/icap-client v0.0.0-20240123094924-5af178158eaf
 # github.com/unrolled/secure => github.com/DeepDiver1975/secure v0.0.0-20240424132259-5b29166734cb
-# github.com/cs3org/reva/v2 => github.com/2403905/reva/v2 v2.0.0-20240501145618-dd1c005507a9
+# github.com/cs3org/reva/v2 => github.com/2403905/reva/v2 v2.0.0-20240502155412-13e7ed59b167