From 0f2c623599b17d030d2eb853e80707ecefb14aea Mon Sep 17 00:00:00 2001
From: ed <s@ocv.me>
Date: Mon, 28 Jul 2025 23:08:41 +0000
Subject: [PATCH] nosub should prevent mkdir

---
 copyparty/httpcli.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/copyparty/httpcli.py b/copyparty/httpcli.py
index 02e56a22..2976a7c1 100644
--- a/copyparty/httpcli.py
+++ b/copyparty/httpcli.py
@@ -3026,6 +3026,9 @@ class HttpCli(object):
         self.gctx = vpath
         vpath = undot(vpath)
         vfs, rem = self.asrv.vfs.get(vpath, self.uname, False, True)
+        if "nosub" in vfs.flags:
+            raise Pebkac(403, "mkdir is forbidden below this folder")
+
         rem = sanitize_vpath(rem, "/")
         fn = vfs.canonical(rem)