From 1f7499dbe8d429013cabd274cb3cc48eceebcb4e Mon Sep 17 00:00:00 2001
From: Phillip Davis <phil@jankaritech.com>
Date: Sat, 11 Jul 2026 21:18:37 +0930
Subject: [PATCH 1/2] chore(deps): update sabre/event PHP dependency

Loading composer repositories with package information
Updating dependencies
Lock file operations: 0 installs, 1 update, 0 removals
  - Upgrading sabre/event (5.1.8 => 5.1.9)
Writing lock file
---
 changelog/unreleased/PHPdependencies20260225onward |  3 ++-
 composer.lock                                      | 10 +++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/changelog/unreleased/PHPdependencies20260225onward b/changelog/unreleased/PHPdependencies20260225onward
index 0e8ff43e57a..52576acbcd5 100644
--- a/changelog/unreleased/PHPdependencies20260225onward
+++ b/changelog/unreleased/PHPdependencies20260225onward
@@ -28,7 +28,7 @@ The following have been updated:
 
  * sabre/dav (4.7.0 to 4.7.1)
 
- * sabre/event (5.1.7 to 5.1.8)
+ * sabre/event (5.1.7 to 5.1.9)
 
  * sabre/vobject (4.5.8 to 4.6.1)
 
@@ -72,3 +72,4 @@ https://github.com/owncloud/core/pull/41666
 https://github.com/owncloud/core/pull/41670
 https://github.com/owncloud/core/pull/41677
 https://github.com/owncloud/core/pull/41681
+https://github.com/owncloud/core/pull/41676
diff --git a/composer.lock b/composer.lock
index 60a75b0cf06..becd23dd4ec 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3330,16 +3330,16 @@
         },
         {
             "name": "sabre/event",
-            "version": "5.1.8",
+            "version": "5.1.9",
             "source": {
                 "type": "git",
                 "url": "https://github.com/sabre-io/event.git",
-                "reference": "1dd5f55421b0092006510264131a4d632d02d2c1"
+                "reference": "743f1d04811fd5b89f67878d002f6a273ccb089f"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/sabre-io/event/zipball/1dd5f55421b0092006510264131a4d632d02d2c1",
-                "reference": "1dd5f55421b0092006510264131a4d632d02d2c1",
+                "url": "https://api.github.com/repos/sabre-io/event/zipball/743f1d04811fd5b89f67878d002f6a273ccb089f",
+                "reference": "743f1d04811fd5b89f67878d002f6a273ccb089f",
                 "shasum": ""
             },
             "require": {
@@ -3392,7 +3392,7 @@
                 "issues": "https://github.com/sabre-io/event/issues",
                 "source": "https://github.com/fruux/sabre-event"
             },
-            "time": "2026-04-27T04:19:36+00:00"
+            "time": "2026-07-07T09:13:04+00:00"
         },
         {
             "name": "sabre/http",

From 11ccfc10fcffaec6eb3ea4c7feb63ff347323e6c Mon Sep 17 00:00:00 2001
From: Phillip Davis <phil@jankaritech.com>
Date: Tue, 14 Jul 2026 19:09:05 +0930
Subject: [PATCH 2/2] fix: ensure that the checkPropFind event occurs before
 httpPropFind

These two events had the same event priority. They happened to get
in the right order because their event entries were sorted
alphabetically, so "c" came before "h".

Sabre\Event is no longer going to do this alphabetical sorting.
It will trigger events in priority order, and then for events with
the same priority, it will trigger the events in the order that they
have been put into the listeners array. This will make the order of
event execution more transparent.

Signed-off-by: Phillip Davis <phil@jankaritech.com>
---
 apps/dav/lib/Connector/Sabre/FilesPlugin.php | 4 +++-
 changelog/unreleased/41676                   | 9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 changelog/unreleased/41676

diff --git a/apps/dav/lib/Connector/Sabre/FilesPlugin.php b/apps/dav/lib/Connector/Sabre/FilesPlugin.php
index d30c27a220c..a5f2bc71abf 100644
--- a/apps/dav/lib/Connector/Sabre/FilesPlugin.php
+++ b/apps/dav/lib/Connector/Sabre/FilesPlugin.php
@@ -166,7 +166,9 @@ public function initialize(\Sabre\DAV\Server $server) {
 		});
 		$this->server->on('beforeMove', [$this, 'checkMove']);
 		$this->server->on('validateTokens', [$this, 'validateTokens'], 0);
-		$this->server->on('method:PROPFIND', [$this, 'checkPropFind']);
+		// checkPropFind has to be done before other events such as httpPropFind
+		// so set its priority below the default of 100
+		$this->server->on('method:PROPFIND', [$this, 'checkPropFind'], 99);
 	}
 
 	/**
diff --git a/changelog/unreleased/41676 b/changelog/unreleased/41676
new file mode 100644
index 00000000000..fefb6aa54e9
--- /dev/null
+++ b/changelog/unreleased/41676
@@ -0,0 +1,9 @@
+Bugfix: reduce priority of checkPropFind event
+
+The checkPropFind event that triggers during an HTTP PROPFIND request must
+happen before the Sabre DAV httpPropFind event. That has been happening
+because it sorts alphabetically first. This change reduces the priority
+number of checkPropFind, increasing its priority, so that it always executes
+first, regardless of any other sort order.
+
+https://github.com/owncloud/core/pull/41676