fix: give regular users global webdav access

admin_users.go

@@ -17,7 +17,7 @@ func defaultPermissions(role string) []string {
 		return []string{PermDownload, PermRedeem, PermWebDAV, PermWebDAVConfig}
 	}
 	if role == RoleUser {
-		return []string{PermDownload, PermRedeem}
+		return []string{PermDownload, PermRedeem, PermWebDAV}
 	}
 	return nil
 }

user_webdav.go

@@ -89,15 +89,23 @@ func (a *App) storageForTask(t *Task) (RemoteStorage, string, bool) {
 	if a.db.First(&user, t.UserID).Error != nil {
 		return nil, "", false
 	}
-	if user.Role == RoleAdmin {
-		if a.cfg.WebDAVURL == "" {
-			return nil, "", false
-		}
-		return a.storage, a.cfg.WebDAVPath, a.storage != nil
-	}
 	if !a.hasPermission(user.ID, PermWebDAV) {
 		return nil, "", false
 	}
+	// Regular users use the system/global WebDAV only. They cannot override
+	// the destination; privileged users may have their own WebDAV config.
+	if user.Role == RoleUser {
+		if a.cfg.WebDAVURL == "" || a.storage == nil {
+			return nil, "", false
+		}
+		return a.storage, a.cfg.WebDAVPath, true
+	}
+	if user.Role == RoleAdmin {
+		if a.cfg.WebDAVURL == "" || a.storage == nil {
+			return nil, "", false
+		}
+		return a.storage, a.cfg.WebDAVPath, true
+	}
 	var cfg WebDAVConfig
 	if a.db.Where("user_id = ? AND enabled = ?", user.ID, true).First(&cfg).Error != nil || cfg.URL == "" {
 		return nil, "", false