feat(webdav): option to disable system file uploads (#2871)

pkg/webdav/webdav.go

@@ -9,6 +9,12 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+	"time"
+
 	"github.com/cloudreve/Cloudreve/v4/application/dependency"
 	"github.com/cloudreve/Cloudreve/v4/ent"
 	"github.com/cloudreve/Cloudreve/v4/inventory"
@@ -26,11 +32,6 @@ import (
 	"github.com/gin-gonic/gin"
 	"github.com/samber/lo"
 	"golang.org/x/tools/container/intsets"
-	"net/http"
-	"net/url"
-	"path"
-	"strings"
-	"time"
 )
 
 const (
@@ -228,6 +229,12 @@ func handlePut(c *gin.Context, user *ent.User, fm manager.FileManager) (status i
 		return purposeStatusCodeFromError(err), err
 	}
 
+	if user.Edges.DavAccounts[0].Options.Enabled(int(types.DavAccountDisableSysFiles)) {
+		if strings.HasPrefix(reqPath.Name(), ".") {
+			return http.StatusMethodNotAllowed, nil
+		}
+	}
+
 	release, ls, status, err := confirmLock(c, fm, user, ancestor, nil, uri, nil)
 	if err != nil {
 		return status, err