A new stricter permission check for WebDAV unzips requires that you check your configuration to make sure unzip works as expected.
Why: B2C Commerce supports an extension to the WebDAV protocol that allows a client to unzip an archive at the server. With this release, the permission check for WebDAV unzips is stricter. Previously, when the client was authenticated as a user (not a client ID), you could unpack a zip file in folders /impex and /impex/src even if files were written to subfolders that the user didn't have write permission for.
Now the write permission on WebDAV paths /impex and /impex/src is strictly interpreted as write to that folder but not to any subfolders. This new stricter check is consistent with the check for single files. For each extracted file, the system checks if the user has write permission to that location.
How: Make sure WebDAV users have write permission to all folders that a WebDAV unzip must write to. If necessary, grant users write permission to WebDAV path /impex/* or /impex/src/foldername/*. Note the use of the wildcard * in these paths. You can also move the zip archive to a more suitable location, or use client ID authentication if more appropriate.
To help you identify if the new stricter permission check affects you, we introduced a new log message to the security logs in Release 20.4. An example of the new log message is as follows: [2020-03-12 09:11:45.764 GMT] [DW-SEC] User: 'johndoe' (Sites), IP: 136.147.56.1, [InvalidZipFileEntry] : No permission to extract [src/instance/sample.zip] of [test.zip] to [/Sites/impex] (in IMPEX)