refactor virtual folders

The same virtual folder can now be shared among users and different
folder quota limits for each user are supported.

Fixes #120

sftpd/handler.go

@@ -69,25 +69,25 @@ func (c Connection) Fileread(request *sftp.Request) (io.ReaderAt, error) {
 	c.Log(logger.LevelDebug, logSender, "fileread requested for path: %#v", p)
 
 	transfer := Transfer{
-		file:                file,
-		readerAt:            r,
-		writerAt:            nil,
-		cancelFn:            cancelFn,
-		path:                p,
-		start:               time.Now(),
-		bytesSent:           0,
-		bytesReceived:       0,
-		user:                c.User,
-		connectionID:        c.ID,
-		transferType:        transferDownload,
-		lastActivity:        time.Now(),
-		isNewFile:           false,
-		protocol:            c.protocol,
-		transferError:       nil,
-		isFinished:          false,
-		minWriteOffset:      0,
-		isExcludedFromQuota: c.User.IsFileExcludedFromQuota(request.Filepath),
-		lock:                new(sync.Mutex),
+		file:           file,
+		readerAt:       r,
+		writerAt:       nil,
+		cancelFn:       cancelFn,
+		path:           p,
+		start:          time.Now(),
+		bytesSent:      0,
+		bytesReceived:  0,
+		user:           c.User,
+		connectionID:   c.ID,
+		transferType:   transferDownload,
+		lastActivity:   time.Now(),
+		isNewFile:      false,
+		protocol:       c.protocol,
+		transferError:  nil,
+		isFinished:     false,
+		minWriteOffset: 0,
+		requestPath:    request.Filepath,
+		lock:           new(sync.Mutex),
 	}
 	addTransfer(&transfer)
 	return &transfer, nil
@@ -112,12 +112,12 @@ func (c Connection) Filewrite(request *sftp.Request) (io.WriterAt, error) {
 		filePath = c.fs.GetAtomicUploadPath(p)
 	}
 
-	stat, statErr := c.fs.Stat(p)
-	if c.fs.IsNotExist(statErr) {
+	stat, statErr := c.fs.Lstat(p)
+	if (statErr == nil && stat.Mode()&os.ModeSymlink == os.ModeSymlink) || c.fs.IsNotExist(statErr) {
 		if !c.User.HasPerm(dataprovider.PermUpload, path.Dir(request.Filepath)) {
 			return nil, sftp.ErrSSHFxPermissionDenied
 		}
-		return c.handleSFTPUploadToNewFile(p, filePath, c.User.IsFileExcludedFromQuota(request.Filepath))
+		return c.handleSFTPUploadToNewFile(p, filePath, request.Filepath)
 	}
 
 	if statErr != nil {
@@ -135,8 +135,7 @@ func (c Connection) Filewrite(request *sftp.Request) (io.WriterAt, error) {
 		return nil, sftp.ErrSSHFxPermissionDenied
 	}
 
-	return c.handleSFTPUploadToExistingFile(request.Pflags(), p, filePath, stat.Size(),
-		c.User.IsFileExcludedFromQuota(request.Filepath))
+	return c.handleSFTPUploadToExistingFile(request.Pflags(), p, filePath, stat.Size(), request.Filepath)
 }
 
 // Filecmd hander for basic SFTP system calls related to files, but not anything to do with reading
@@ -301,29 +300,46 @@ func (c Connection) handleSFTPSetstat(filePath string, request *sftp.Request) er
 	return nil
 }
 
-func (c Connection) handleSFTPRename(sourcePath string, targetPath string, request *sftp.Request) error {
-	if c.fs.GetRelativePath(sourcePath) == "/" {
-		c.Log(logger.LevelWarn, logSender, "renaming root dir is not allowed")
+func (c Connection) handleSFTPRename(sourcePath, targetPath string, request *sftp.Request) error {
+	if !c.isRenamePermitted(sourcePath, request) {
 		return sftp.ErrSSHFxPermissionDenied
 	}
-	if c.User.IsVirtualFolder(request.Filepath) || c.User.IsVirtualFolder(request.Target) {
-		c.Log(logger.LevelWarn, logSender, "renaming a virtual folder is not allowed")
-		return sftp.ErrSSHFxPermissionDenied
+	if c.User.HasVirtualFoldersInside(request.Filepath) {
+		if fi, err := c.fs.Stat(sourcePath); err == nil {
+			if fi.IsDir() {
+				c.Log(logger.LevelDebug, logSender, "renaming the folder %#v is not supported: it has virtual folders inside it",
+					request.Filepath)
+				return sftp.ErrSSHFxOpUnsupported
+			}
+		}
 	}
-	if !c.User.IsFileAllowed(request.Filepath) || !c.User.IsFileAllowed(request.Target) {
-		if fi, err := c.fs.Lstat(sourcePath); err == nil && fi.Mode().IsRegular() {
-			c.Log(logger.LevelDebug, logSender, "renaming file is not allowed, source: %#v target: %#v", request.Filepath,
-				request.Target)
+	initialSize := int64(-1)
+	if fi, err := c.fs.Lstat(targetPath); err == nil {
+		if fi.IsDir() {
+			c.Log(logger.LevelWarn, logSender, "attempted to rename %#v overwriting an existing directory %#v", sourcePath, targetPath)
+			return sftp.ErrSSHFxOpUnsupported
+		}
+		// we are overwriting an existing file/symlink
+		if fi.Mode().IsRegular() {
+			initialSize = fi.Size()
+		}
+		if !c.User.HasPerm(dataprovider.PermOverwrite, path.Dir(request.Target)) {
+			c.Log(logger.LevelDebug, logSender, "renaming is not allowed, source: %#v target: %#v. "+
+				"Target exists but the user has no overwrite permission", request.Filepath, request.Target)
 			return sftp.ErrSSHFxPermissionDenied
 		}
 	}
-	if !c.User.HasPerm(dataprovider.PermRename, path.Dir(request.Target)) {
-		return sftp.ErrSSHFxPermissionDenied
+	if !c.hasSpaceForRename(request, initialSize, sourcePath) {
+		c.Log(logger.LevelInfo, logSender, "denying cross rename due to space limit")
+		return sftp.ErrSSHFxFailure
 	}
 	if err := c.fs.Rename(sourcePath, targetPath); err != nil {
-		c.Log(logger.LevelWarn, logSender, "failed to rename file, source: %#v target: %#v: %+v", sourcePath, targetPath, err)
+		c.Log(logger.LevelWarn, logSender, "failed to rename %#v -> %#v: %+v", sourcePath, targetPath, err)
 		return vfs.GetSFTPError(c.fs, err)
 	}
+	if dataprovider.GetQuotaTracking() > 0 {
+		c.updateQuotaAfterRename(request, targetPath, initialSize) //nolint:errcheck
+	}
 	logger.CommandLog(renameLogSender, sourcePath, targetPath, c.User.Username, "", c.ID, c.protocol, -1, -1, "", "", "")
 	// the returned error is used in test cases only, we already log the error inside executeAction
 	go executeAction(newActionNotification(c.User, operationRename, sourcePath, targetPath, "", 0, nil)) //nolint:errcheck
@@ -339,6 +355,10 @@ func (c Connection) handleSFTPRmdir(dirPath string, request *sftp.Request) error
 		c.Log(logger.LevelWarn, logSender, "removing a virtual folder is not allowed: %#v", request.Filepath)
 		return sftp.ErrSSHFxPermissionDenied
 	}
+	if c.User.HasVirtualFoldersInside(request.Filepath) {
+		c.Log(logger.LevelWarn, logSender, "removing a directory with a virtual folder inside is not allowed: %#v", request.Filepath)
+		return sftp.ErrSSHFxOpUnsupported
+	}
 	if !c.User.HasPerm(dataprovider.PermDelete, path.Dir(request.Filepath)) {
 		return sftp.ErrSSHFxPermissionDenied
 	}
@@ -375,11 +395,14 @@ func (c Connection) handleSFTPSymlink(sourcePath string, targetPath string, requ
 	if !c.User.HasPerm(dataprovider.PermCreateSymlinks, path.Dir(request.Target)) {
 		return sftp.ErrSSHFxPermissionDenied
 	}
+	if c.isCrossFoldersRequest(request) {
+		c.Log(logger.LevelWarn, logSender, "cross folder symlink is not supported, src: %v dst: %v", request.Filepath, request.Target)
+		return sftp.ErrSSHFxFailure
+	}
 	if err := c.fs.Symlink(sourcePath, targetPath); err != nil {
 		c.Log(logger.LevelWarn, logSender, "failed to create symlink %#v -> %#v: %+v", sourcePath, targetPath, err)
 		return vfs.GetSFTPError(c.fs, err)
 	}
-
 	logger.CommandLog(symlinkLogSender, sourcePath, targetPath, c.User.Username, "", c.ID, c.protocol, -1, -1, "", "", "")
 	return nil
 }
@@ -437,7 +460,13 @@ func (c Connection) handleSFTPRemove(filePath string, request *sftp.Request) err
 
 	logger.CommandLog(removeLogSender, filePath, "", c.User.Username, "", c.ID, c.protocol, -1, -1, "", "", "")
 	if fi.Mode()&os.ModeSymlink != os.ModeSymlink {
-		if !c.User.IsFileExcludedFromQuota(request.Filepath) {
+		vfolder, err := c.User.GetVirtualFolderForPath(request.Filepath)
+		if err == nil {
+			dataprovider.UpdateVirtualFolderQuota(dataProvider, vfolder.BaseVirtualFolder, -1, -size, false) //nolint:errcheck
+			if vfolder.IsIncludedInUserQuota() {
+				dataprovider.UpdateUserQuota(dataProvider, c.User, -1, -size, false) //nolint:errcheck
+			}
+		} else {
 			dataprovider.UpdateUserQuota(dataProvider, c.User, -1, -size, false) //nolint:errcheck
 		}
 	}
@@ -448,50 +477,50 @@ func (c Connection) handleSFTPRemove(filePath string, request *sftp.Request) err
 	return sftp.ErrSSHFxOk
 }
 
-func (c Connection) handleSFTPUploadToNewFile(requestPath, filePath string, isExcludedFromQuota bool) (io.WriterAt, error) {
-	if !c.hasSpace(true) {
-		c.Log(logger.LevelInfo, logSender, "denying file write due to space limit")
+func (c Connection) handleSFTPUploadToNewFile(resolvedPath, filePath, requestPath string) (io.WriterAt, error) {
+	if !c.hasSpace(true, requestPath) {
+		c.Log(logger.LevelInfo, logSender, "denying file write due to quota limits")
 		return nil, sftp.ErrSSHFxFailure
 	}
 
 	file, w, cancelFn, err := c.fs.Create(filePath, 0)
 	if err != nil {
-		c.Log(logger.LevelWarn, logSender, "error creating file %#v: %+v", requestPath, err)
+		c.Log(logger.LevelWarn, logSender, "error creating file %#v: %+v", resolvedPath, err)
 		return nil, vfs.GetSFTPError(c.fs, err)
 	}
 
 	vfs.SetPathPermissions(c.fs, filePath, c.User.GetUID(), c.User.GetGID())
 
 	transfer := Transfer{
-		file:                file,
-		writerAt:            w,
-		readerAt:            nil,
-		cancelFn:            cancelFn,
-		path:                requestPath,
-		start:               time.Now(),
-		bytesSent:           0,
-		bytesReceived:       0,
-		user:                c.User,
-		connectionID:        c.ID,
-		transferType:        transferUpload,
-		lastActivity:        time.Now(),
-		isNewFile:           true,
-		protocol:            c.protocol,
-		transferError:       nil,
-		isFinished:          false,
-		minWriteOffset:      0,
-		isExcludedFromQuota: isExcludedFromQuota,
-		lock:                new(sync.Mutex),
+		file:           file,
+		writerAt:       w,
+		readerAt:       nil,
+		cancelFn:       cancelFn,
+		path:           resolvedPath,
+		start:          time.Now(),
+		bytesSent:      0,
+		bytesReceived:  0,
+		user:           c.User,
+		connectionID:   c.ID,
+		transferType:   transferUpload,
+		lastActivity:   time.Now(),
+		isNewFile:      true,
+		protocol:       c.protocol,
+		transferError:  nil,
+		isFinished:     false,
+		minWriteOffset: 0,
+		requestPath:    requestPath,
+		lock:           new(sync.Mutex),
 	}
 	addTransfer(&transfer)
 	return &transfer, nil
 }
 
-func (c Connection) handleSFTPUploadToExistingFile(pflags sftp.FileOpenFlags, requestPath, filePath string,
-	fileSize int64, isExcludedFromQuota bool) (io.WriterAt, error) {
+func (c Connection) handleSFTPUploadToExistingFile(pflags sftp.FileOpenFlags, resolvedPath, filePath string,
+	fileSize int64, requestPath string) (io.WriterAt, error) {
 	var err error
-	if !c.hasSpace(false) {
-		c.Log(logger.LevelInfo, logSender, "denying file write due to space limit")
+	if !c.hasSpace(false, requestPath) {
+		c.Log(logger.LevelInfo, logSender, "denying file write due to quota limits")
 		return nil, sftp.ErrSSHFxFailure
 	}
 
@@ -499,16 +528,15 @@ func (c Connection) handleSFTPUploadToExistingFile(pflags sftp.FileOpenFlags, re
 	osFlags := getOSOpenFlags(pflags)
 
 	if pflags.Append && osFlags&os.O_TRUNC == 0 && !c.fs.IsUploadResumeSupported() {
-		c.Log(logger.LevelInfo, logSender, "upload resume requested for path: %#v but not supported in fs implementation",
-			requestPath)
+		c.Log(logger.LevelInfo, logSender, "upload resume requested for path: %#v but not supported in fs implementation", resolvedPath)
 		return nil, sftp.ErrSSHFxOpUnsupported
 	}
 
 	if isAtomicUploadEnabled() && c.fs.IsAtomicUploadSupported() {
-		err = c.fs.Rename(requestPath, filePath)
+		err = c.fs.Rename(resolvedPath, filePath)
 		if err != nil {
 			c.Log(logger.LevelWarn, logSender, "error renaming existing file for atomic upload, source: %#v, dest: %#v, err: %+v",
-				requestPath, filePath, err)
+				resolvedPath, filePath, err)
 			return nil, vfs.GetSFTPError(c.fs, err)
 		}
 	}
@@ -525,7 +553,13 @@ func (c Connection) handleSFTPUploadToExistingFile(pflags sftp.FileOpenFlags, re
 		minWriteOffset = fileSize
 	} else {
 		if vfs.IsLocalOsFs(c.fs) {
-			if !isExcludedFromQuota {
+			vfolder, err := c.User.GetVirtualFolderForPath(requestPath)
+			if err == nil {
+				dataprovider.UpdateVirtualFolderQuota(dataProvider, vfolder.BaseVirtualFolder, 0, -fileSize, false) //nolint:errcheck
+				if vfolder.IsIncludedInUserQuota() {
+					dataprovider.UpdateUserQuota(dataProvider, c.User, 0, -fileSize, false) //nolint:errcheck
+				}
+			} else {
 				dataprovider.UpdateUserQuota(dataProvider, c.User, 0, -fileSize, false) //nolint:errcheck
 			}
 		} else {
@@ -536,48 +570,104 @@ func (c Connection) handleSFTPUploadToExistingFile(pflags sftp.FileOpenFlags, re
 	vfs.SetPathPermissions(c.fs, filePath, c.User.GetUID(), c.User.GetGID())
 
 	transfer := Transfer{
-		file:                file,
-		writerAt:            w,
-		readerAt:            nil,
-		cancelFn:            cancelFn,
-		path:                requestPath,
-		start:               time.Now(),
-		bytesSent:           0,
-		bytesReceived:       0,
-		user:                c.User,
-		connectionID:        c.ID,
-		transferType:        transferUpload,
-		lastActivity:        time.Now(),
-		isNewFile:           false,
-		protocol:            c.protocol,
-		transferError:       nil,
-		isFinished:          false,
-		minWriteOffset:      minWriteOffset,
-		initialSize:         initialSize,
-		isExcludedFromQuota: isExcludedFromQuota,
-		lock:                new(sync.Mutex),
+		file:           file,
+		writerAt:       w,
+		readerAt:       nil,
+		cancelFn:       cancelFn,
+		path:           resolvedPath,
+		start:          time.Now(),
+		bytesSent:      0,
+		bytesReceived:  0,
+		user:           c.User,
+		connectionID:   c.ID,
+		transferType:   transferUpload,
+		lastActivity:   time.Now(),
+		isNewFile:      false,
+		protocol:       c.protocol,
+		transferError:  nil,
+		isFinished:     false,
+		minWriteOffset: minWriteOffset,
+		initialSize:    initialSize,
+		requestPath:    requestPath,
+		lock:           new(sync.Mutex),
 	}
 	addTransfer(&transfer)
 	return &transfer, nil
 }
 
-func (c Connection) hasSpace(checkFiles bool) bool {
-	if (checkFiles && c.User.QuotaFiles > 0) || c.User.QuotaSize > 0 {
-		numFile, size, err := dataprovider.GetUsedQuota(dataProvider, c.User.Username)
-		if err != nil {
-			if _, ok := err.(*dataprovider.MethodDisabledError); ok {
-				c.Log(logger.LevelWarn, logSender, "quota enforcement not possible for user %#v: %v", c.User.Username, err)
+func (c Connection) hasSpaceForRename(request *sftp.Request, initialSize int64, sourcePath string) bool {
+	if dataprovider.GetQuotaTracking() == 0 {
+		return true
+	}
+	sourceFolder, errSrc := c.User.GetVirtualFolderForPath(request.Filepath)
+	dstFolder, errDst := c.User.GetVirtualFolderForPath(request.Target)
+	if errSrc != nil && errDst != nil {
+		// rename inside the user home dir
+		return true
+	}
+	if errSrc == nil && errDst == nil {
+		// rename between virtual folders
+		if sourceFolder.MappedPath == dstFolder.MappedPath {
+			// rename inside the same virtual folder
+			return true
+		}
+	}
+	if errSrc != nil && dstFolder.IsIncludedInUserQuota() {
+		// rename between user root dir and a virtual folder included in user quota
+		return true
+	}
+	if !c.hasSpace(true, request.Target) {
+		if initialSize != -1 {
+			// we are overquota but we are overwriting a file so we check the quota size
+			if c.hasSpace(false, request.Target) {
+				// we have enough quota size
 				return true
 			}
-			c.Log(logger.LevelWarn, logSender, "error getting used quota for %#v: %v", c.User.Username, err)
-			return false
+			if fi, err := c.fs.Lstat(sourcePath); err == nil {
+				if fi.Mode().IsRegular() {
+					// we have space if we are overwriting a bigger file with a smaller one
+					return initialSize >= fi.Size()
+				}
+			}
 		}
-		if (checkFiles && c.User.QuotaFiles > 0 && numFile >= c.User.QuotaFiles) ||
-			(c.User.QuotaSize > 0 && size >= c.User.QuotaSize) {
-			c.Log(logger.LevelDebug, logSender, "quota exceed for user %#v, num files: %v/%v, size: %v/%v check files: %v",
-				c.User.Username, numFile, c.User.QuotaFiles, size, c.User.QuotaSize, checkFiles)
-			return false
+		return false
+	}
+	return true
+}
+
+func (c Connection) hasSpace(checkFiles bool, requestPath string) bool {
+	if dataprovider.GetQuotaTracking() == 0 {
+		return true
+	}
+	var quotaSize, usedSize int64
+	var quotaFiles, numFiles int
+	var err error
+	var vfolder vfs.VirtualFolder
+	vfolder, err = c.User.GetVirtualFolderForPath(requestPath)
+	if err == nil && !vfolder.IsIncludedInUserQuota() {
+		if vfolder.HasNoQuotaRestrictions(checkFiles) {
+			return true
 		}
+		quotaSize = vfolder.QuotaSize
+		quotaFiles = vfolder.QuotaFiles
+		numFiles, usedSize, err = dataprovider.GetUsedVirtualFolderQuota(dataProvider, vfolder.MappedPath)
+	} else {
+		if c.User.HasNoQuotaRestrictions(checkFiles) {
+			return true
+		}
+		quotaSize = c.User.QuotaSize
+		quotaFiles = c.User.QuotaFiles
+		numFiles, usedSize, err = dataprovider.GetUsedQuota(dataProvider, c.User.Username)
+	}
+	if err != nil {
+		c.Log(logger.LevelWarn, logSender, "error getting used quota for %#v request path %#v: %v", c.User.Username, requestPath, err)
+		return false
+	}
+	if (checkFiles && quotaFiles > 0 && numFiles >= quotaFiles) ||
+		(quotaSize > 0 && usedSize >= quotaSize) {
+		c.Log(logger.LevelDebug, logSender, "quota exceed for user %#v, request path %#v, num files: %v/%v, size: %v/%v check files: %v",
+			c.User.Username, requestPath, numFiles, quotaFiles, usedSize, quotaSize, checkFiles)
+		return false
 	}
 	return true
 }
@@ -612,3 +702,143 @@ func getOSOpenFlags(requestFlags sftp.FileOpenFlags) (flags int) {
 	}
 	return osFlags
 }
+
+func (c Connection) isCrossFoldersRequest(request *sftp.Request) bool {
+	sourceFolder, errSrc := c.User.GetVirtualFolderForPath(request.Filepath)
+	dstFolder, errDst := c.User.GetVirtualFolderForPath(request.Target)
+	if errSrc != nil && errDst != nil {
+		return false
+	}
+	if errSrc == nil && errDst == nil {
+		return sourceFolder.MappedPath != dstFolder.MappedPath
+	}
+	return true
+}
+
+func (c Connection) isRenamePermitted(sourcePath string, request *sftp.Request) bool {
+	if c.fs.GetRelativePath(sourcePath) == "/" {
+		c.Log(logger.LevelWarn, logSender, "renaming root dir is not allowed")
+		return false
+	}
+	if c.User.IsVirtualFolder(request.Filepath) || c.User.IsVirtualFolder(request.Target) {
+		c.Log(logger.LevelWarn, logSender, "renaming a virtual folder is not allowed")
+		return false
+	}
+	if !c.User.IsFileAllowed(request.Filepath) || !c.User.IsFileAllowed(request.Target) {
+		if fi, err := c.fs.Lstat(sourcePath); err == nil && fi.Mode().IsRegular() {
+			c.Log(logger.LevelDebug, logSender, "renaming file is not allowed, source: %#v target: %#v", request.Filepath,
+				request.Target)
+			return false
+		}
+	}
+	if !c.User.HasPerm(dataprovider.PermRename, path.Dir(request.Target)) {
+		return false
+	}
+	return true
+}
+
+func (c Connection) updateQuotaMoveBetweenVFolders(sourceFolder, dstFolder vfs.VirtualFolder, initialSize, filesSize int64, numFiles int) {
+	if sourceFolder.MappedPath == dstFolder.MappedPath {
+		// both files are inside the same virtual folder
+		if initialSize != -1 {
+			dataprovider.UpdateVirtualFolderQuota(dataProvider, dstFolder.BaseVirtualFolder, -numFiles, -initialSize, false) //nolint:errcheck
+			if dstFolder.IsIncludedInUserQuota() {
+				dataprovider.UpdateUserQuota(dataProvider, c.User, -numFiles, -initialSize, false) //nolint:errcheck
+			}
+		}
+		return
+	}
+	// files are inside different virtual folders
+	dataprovider.UpdateVirtualFolderQuota(dataProvider, sourceFolder.BaseVirtualFolder, -numFiles, -filesSize, false) //nolint:errcheck
+	if sourceFolder.IsIncludedInUserQuota() {
+		dataprovider.UpdateUserQuota(dataProvider, c.User, -numFiles, -filesSize, false) //nolint:errcheck
+	}
+	if initialSize == -1 {
+		dataprovider.UpdateVirtualFolderQuota(dataProvider, dstFolder.BaseVirtualFolder, numFiles, filesSize, false) //nolint:errcheck
+		if dstFolder.IsIncludedInUserQuota() {
+			dataprovider.UpdateUserQuota(dataProvider, c.User, numFiles, filesSize, false) //nolint:errcheck
+		}
+	} else {
+		// we cannot have a directory here, initialSize != -1 only for files
+		dataprovider.UpdateVirtualFolderQuota(dataProvider, dstFolder.BaseVirtualFolder, 0, filesSize-initialSize, false) //nolint:errcheck
+		if dstFolder.IsIncludedInUserQuota() {
+			dataprovider.UpdateUserQuota(dataProvider, c.User, 0, filesSize-initialSize, false) //nolint:errcheck
+		}
+	}
+}
+
+func (c Connection) updateQuotaMoveFromVFolder(sourceFolder vfs.VirtualFolder, initialSize, filesSize int64, numFiles int) {
+	// move between a virtual folder and the user home dir
+	dataprovider.UpdateVirtualFolderQuota(dataProvider, sourceFolder.BaseVirtualFolder, -numFiles, -filesSize, false) //nolint:errcheck
+	if sourceFolder.IsIncludedInUserQuota() {
+		dataprovider.UpdateUserQuota(dataProvider, c.User, -numFiles, -filesSize, false) //nolint:errcheck
+	}
+	if initialSize == -1 {
+		dataprovider.UpdateUserQuota(dataProvider, c.User, numFiles, filesSize, false) //nolint:errcheck
+	} else {
+		// we cannot have a directory here, initialSize != -1 only for files
+		dataprovider.UpdateUserQuota(dataProvider, c.User, 0, filesSize-initialSize, false) //nolint:errcheck
+	}
+}
+
+func (c Connection) updateQuotaMoveToVFolder(dstFolder vfs.VirtualFolder, initialSize, filesSize int64, numFiles int) {
+	// move between the user home dir and a virtual folder
+	dataprovider.UpdateUserQuota(dataProvider, c.User, -numFiles, -filesSize, false) //nolint:errcheck
+	if initialSize == -1 {
+		dataprovider.UpdateVirtualFolderQuota(dataProvider, dstFolder.BaseVirtualFolder, numFiles, filesSize, false) //nolint:errcheck
+		if dstFolder.IsIncludedInUserQuota() {
+			dataprovider.UpdateUserQuota(dataProvider, c.User, numFiles, filesSize, false) //nolint:errcheck
+		}
+	} else {
+		// we cannot have a directory here, initialSize != -1 only for files
+		dataprovider.UpdateVirtualFolderQuota(dataProvider, dstFolder.BaseVirtualFolder, 0, filesSize-initialSize, false) //nolint:errcheck
+		if dstFolder.IsIncludedInUserQuota() {
+			dataprovider.UpdateUserQuota(dataProvider, c.User, 0, filesSize-initialSize, false) //nolint:errcheck
+		}
+	}
+}
+
+func (c Connection) updateQuotaAfterRename(request *sftp.Request, targetPath string, initialSize int64) error {
+	// we don't allow to overwrite an existing directory so targetPath can be:
+	// - a new file, a symlink is as a new file here
+	// - a file overwriting an existing one
+	// - a new directory
+	// initialSize != -1 only when overwriting files
+	sourceFolder, errSrc := c.User.GetVirtualFolderForPath(request.Filepath)
+	dstFolder, errDst := c.User.GetVirtualFolderForPath(request.Target)
+	if errSrc != nil && errDst != nil {
+		// both files are contained inside the user home dir
+		if initialSize != -1 {
+			// we cannot have a directory here
+			dataprovider.UpdateUserQuota(dataProvider, c.User, -1, -initialSize, false) //nolint:errcheck
+		}
+		return nil
+	}
+
+	filesSize := int64(0)
+	numFiles := 1
+	if fi, err := c.fs.Stat(targetPath); err == nil {
+		if fi.Mode().IsDir() {
+			numFiles, filesSize, err = c.fs.GetDirSize(targetPath)
+			if err != nil {
+				logger.Warn(logSender, "", "failed to update quota after rename, error scanning moved folder %#v: %v", targetPath, err)
+				return err
+			}
+		} else {
+			filesSize = fi.Size()
+		}
+	} else {
+		c.Log(logger.LevelWarn, logSender, "failed to update quota after rename, file %#v stat error: %+v", targetPath, err)
+		return err
+	}
+	if errSrc == nil && errDst == nil {
+		c.updateQuotaMoveBetweenVFolders(sourceFolder, dstFolder, initialSize, filesSize, numFiles)
+	}
+	if errSrc == nil && errDst != nil {
+		c.updateQuotaMoveFromVFolder(sourceFolder, initialSize, filesSize, numFiles)
+	}
+	if errSrc != nil && errDst == nil {
+		c.updateQuotaMoveToVFolder(dstFolder, initialSize, filesSize, numFiles)
+	}
+	return nil
+}