Steps to reproduce

1. lock a folder curl -X LOCK -u admin:admin http://localhost/owncloud-core/remote.php/webdav/public-folder -d "<?xml version='1.0' encoding='UTF-8'?><d:lockinfo xmlns:d='DAV:'> <d:lockscope><d:shared/></d:lockscope></d:lockinfo>"
2. share this folder via public link
3. upload new files or overwrite existing files in that folder via new public webdav API curl -X PUT http://localhost/owncloud-core/remote.php/dav/public-files/0M2kxLVbYuIOSPZ/12.txt -d "222"

Expected behaviour

upload does not work

Actual behaviour

files can be uploaded and overwritten

CC @DeepDiver1975