From 84e254d86e76c473456ed36e0abd4424844b9844 Mon Sep 17 00:00:00 2001
From: David Benque <david.benque@xwiki.com>
Date: Tue, 22 Aug 2023 11:46:00 +0100
Subject: [PATCH 1/2] Bump version to 5.4.1

---
 customize.dist/pages.js | 2 +-
 package-lock.json       | 2 +-
 package.json            | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/customize.dist/pages.js b/customize.dist/pages.js
index 123134206..0ded98bb7 100644
--- a/customize.dist/pages.js
+++ b/customize.dist/pages.js
@@ -95,7 +95,7 @@ define([
         return h('a', attrs, [icon, text]);
     };
 
-    Pages.versionString = "5.4.0";
+    Pages.versionString = "5.4.1";
 
     var customURLs = Pages.customURLs = {};
     (function () {
diff --git a/package-lock.json b/package-lock.json
index 786023207..19931c216 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "cryptpad",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
diff --git a/package.json b/package.json
index c0831f87b..986109775 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "cryptpad",
   "description": "realtime collaborative visual editor with zero knowlege server",
-  "version": "5.4.0",
+  "version": "5.4.1",
   "license": "AGPL-3.0+",
   "repository": {
     "type": "git",

From 58331b067d82d2b6477ab3f98d9008e7c5a58d4b Mon Sep 17 00:00:00 2001
From: Wolfgang Ginolas <wolfgang.ginolas@gwif.eu>
Date: Tue, 22 Aug 2023 13:13:19 +0200
Subject: [PATCH 2/2] Fix collaboration of Nextcloud integration

---
 lib/http-worker.js | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/http-worker.js b/lib/http-worker.js
index 147a7d841..3b98a4422 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -272,9 +272,18 @@ app.get(mainPagePattern, Express.static('./customize.dist'));
 app.use("/blob", Express.static(Path.resolve(Env.paths.blob), {
     maxAge: Env.DEV_MODE? "0d": "365d"
 }));
-app.head("/datastore", Express.static(Env.paths.data, {
-    maxAge: "0d"
-}));
+app.use("/datastore",
+    (req, res, next) => {
+        if (req.method === 'HEAD') {
+            next();
+        } else {
+            res.status(403).end();
+        }
+    },
+    Express.static(Env.paths.data, {
+        maxAge: "0d"
+    }
+));
 
 app.use('/block/', function (req, res, next) {
     var parsed = Path.parse(req.url);