"nosub" volflag circumventable to create subdirectories

[aspynect]

Describe the bug

"nosub" volflag does not work as intended when uploading directories that contain files

To Reproduce

In a share with the "nosub" volflag (cannot create subfolders), upload a directory (or nested directories) that contain at least one file. Upon receiving error "server rejected the request to initiate upload; error 500: no subdirectories allowed", any directories that contained (recursive OK) a file will have been created anyway, empty.

Expected behavior

No folder is created, as no subfolders are allowed to be created (mkdir UI feature does not work)

Screenshots

Server details

• Oracle Linux Server 9.8 aarch64 / Linux 6.12.0-205.92.4.2.el9uek.aarch64 / KVM Virtual Machine (virt-7.2)
• copyparty v1.20.21 "sftp is fine too" (2026-08-17)
  CPython v3.9.25 on Linux64 [GCC 11.5.0 20240719 (Red Hat 11.5.0-14.0.1)]
  sqlite 3.34.1*1 | jinja 2.11.3 | pyftpd 1.5.10 | tftp 0.4.0 | miko (None)
• systemd-service
• global config:

[global]
  daw
  e2d
  e2ts
  -grid
  e2dsa
  magic
  favico: 
  theme: 7
  th-ff-jpg
  rproxy: 1
  no-hash: .
  i: 127.0.0.1
  name: Storage |
  xff-src: 127.0.0.1
  hist: ~/.cache/copyparty
  xff-hdr: cf-connecting-ip
  lo: $LOGS_DIRECTORY/%m-%d-%Y.log
  html-head: <link rel="stylesheet" href="/place/copyparty.css">

• folder config:

[/]
  /files
  accs:
    rwmd.a: @admin
    rwm: @oomfs
    r: *
  flags: 
    grid
    e2ds
    ufavico: 🐱
    ui_nosrvi
    ui_nolbar
    ui_noctxb
    ui_norepl
    sz: 0-67m
    vmaxn: 256
    maxn: 15,600
    nosub

• directory persmissions:
  drwxrwsr-x+ 4 copyparty worker 4096 Aug 19 02:34 /files
• access control list:

# file: files
# owner: copyparty
# group: worker
# flags: -s-
user::rwx
group::rwx
group:worker:rwx
mask::rwx
other::r-x
default:user::rwx
default:group::rwx
default:group:worker:rwx
default:mask::rwx
default:other::r-x

• nginx reverse proxy on OCI run through cloudflare

Client details

The server shouldn't allowed a directory to be created so this shouldn't matter but for the sake of thoroughness:

• the device type and model: PC
• OS version: Windows 10 Home 22H2 19045.7663
• browser version: Zen 1.21.14b (64-bit)

Server log

02:48:56.059 ***.**.***.*** 45624   LOG: GET  / @oomf
02:48:56.439 ***.**.***.*** 45624   LOG: GET  /?tree= @oomf
02:49:04.803 ***.**.***.*** 45668   LOG: GET  / @oomf
02:49:04.991 ***.**.***.*** 45668   LOG: GET  /?tree= @oomf
02:49:48.100 ***.**.***.*** 45668   LOG: POST /bug_test/bug_test_2/bug_test_3/ @oomf
02:49:48.101 ***.**.***.*** 45668   LOG: POST len=113 type=utf-8 ip=***.**.***.*** user=oomf req='/bug_test/bug_test_2/bug_test_3/' json={'name': 'a.txt', 'size': 17, 'lmod': 1787122180.379, 'life': 0, 'hash': '1 chunks'}
02:49:48.103 ***.**.***.*** 45668  WARN: http500: no subdirectories allowed, '/bug_test/bug_test_2/bug_test_3'
02:49:51.289 ***.**.***.*** 50366   LOG: GET  / @oomf
02:49:51.451 ***.**.***.*** 50366   LOG: GET  /place/copyparty.css @oomf
02:49:51.451 ***.**.***.*** 50366   LOG:      /place/copyparty.css plain 304
02:49:51.548 ***.**.***.*** 50366   LOG: GET  /?tree= @oomf
02:49:53.387 ***.**.***.*** 50366   LOG: GET  /bug_test/?ls @oomf
02:49:54.116 ***.**.***.*** 50366   LOG: GET  /bug_test/bug_test_2/?ls&rtt=50 @oomf
02:49:54.685 ***.**.***.*** 50366   LOG: GET  /bug_test/bug_test_2/bug_test_3/?ls&rtt=49 @oomf