From 149ec3555f49a4bff7943f3f625d878b0f20a580 Mon Sep 17 00:00:00 2001 From: Andrew Ruthven Date: Sun, 5 Feb 2023 01:32:16 +1300 Subject: [PATCH] CLASS is an optional field, don't set it to PUBLIC As specified in RFC5545 the CLASS field is optional, and if it isn't present is treated as PUBLIC. To allow a is-not-defined prop-filter to find resources without CLASS set, we need to not store in the database. This turns out to be okay, because to enforce privacy we always check to see if it is PRIVATE or CONFIDENTIAL. We never check to see if it is PUBLIC. Closes #284. --- inc/WritableCollection.php | 6 +- inc/caldav-PUT-functions.php | 15 +---- inc/caldav-REPORT-calquery.php | 1 + .../2500-is-defined-Setup-PUT-collection.data | 7 +-- ...-is-defined-REPORT-is-defined-CLASS.result | 62 +++++++++++++++++++ ...07-is-defined-REPORT-is-defined-CLASS.test | 33 ++++++++++ ...defined-REPORT-is-not-defined-CLASS.result | 35 +++++++++++ ...s-defined-REPORT-is-not-defined-CLASS.test | 33 ++++++++++ 8 files changed, 171 insertions(+), 21 deletions(-) create mode 100644 testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.result create mode 100644 testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.test create mode 100644 testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.result create mode 100644 testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.test diff --git a/inc/WritableCollection.php b/inc/WritableCollection.php index 6ddae80d..0b69bf48 100644 --- a/inc/WritableCollection.php +++ b/inc/WritableCollection.php @@ -180,11 +180,7 @@ class WritableCollection extends DAVResource { $calitem_params[':dtstamp'] = $dtstamp; $class = $first->GetPValue('CLASS'); - /* - * It seems that some calendar clients don't set a class... - * RFC2445, 4.8.1.3: Default is PUBLIC - */ - if ( $this->IsPublicOnly() || !isset($class) || $class == '' ) { + if ( $this->IsPublicOnly() && isset($class)) { $class = 'PUBLIC'; } $calitem_params[':class'] = $class; diff --git a/inc/caldav-PUT-functions.php b/inc/caldav-PUT-functions.php index d7a3b051..5f547412 100644 --- a/inc/caldav-PUT-functions.php +++ b/inc/caldav-PUT-functions.php @@ -1170,9 +1170,8 @@ EOSQL; if ( empty($dtstamp) ) $dtstamp = $last_modified; $calitem_params[':dtstamp'] = $dtstamp; - /** RFC2445, 4.8.1.3: Default is PUBLIC, or also if overridden by the collection settings */ - $class = ($collection->public_events_only == 't' ? 'PUBLIC' : $first->GetPValue('CLASS') ); - if ( !isset($class) || $class == '' ) $class = 'PUBLIC'; + /** Allow overridding class by the collection settings */ + $class = ($collection->public_events_only == 't' && isset($class) ? 'PUBLIC' : $first->GetPValue('CLASS') ); $calitem_params[':class'] = $class; @@ -1534,18 +1533,10 @@ function write_resource( DAVResource $resource, $caldav_data, DAVResource $colle $class = $first->GetPValue('CLASS'); /* Check and see if we should over ride the class. */ /** @todo is there some way we can move this out of this function? Or at least get rid of the need for the SQL query here. */ - if ( public_events_only($user_no, $path) ) { + if ( public_events_only($user_no, $path) && isset($class) ) { $class = 'PUBLIC'; } - /* - * It seems that some calendar clients don't set a class... - * RFC2445, 4.8.1.3: - * Default is PUBLIC - */ - if ( !isset($class) || $class == '' ) { - $class = 'PUBLIC'; - } $calitem_params[':class'] = $class; /** Calculate what timezone to set, first, if possible */ diff --git a/inc/caldav-REPORT-calquery.php b/inc/caldav-REPORT-calquery.php index 18177aae..d631e53e 100644 --- a/inc/caldav-REPORT-calquery.php +++ b/inc/caldav-REPORT-calquery.php @@ -125,6 +125,7 @@ function SqlFilterFragment( $filter, $components, $property = null, $parameter = case 'priority': case 'status': + case 'class': if ($not_defined == "not ") { // "not IS NOT NULL" is a syntax error in SQL. $property_defined_match = "IS NULL"; diff --git a/testing/tests/regression-suite/2500-is-defined-Setup-PUT-collection.data b/testing/tests/regression-suite/2500-is-defined-Setup-PUT-collection.data index ea8129f0..51c4ed93 100644 --- a/testing/tests/regression-suite/2500-is-defined-Setup-PUT-collection.data +++ b/testing/tests/regression-suite/2500-is-defined-Setup-PUT-collection.data @@ -18,8 +18,8 @@ UID:19920901T130000Z-123407@host.com DTSTAMP:19920901T130000Z DTSTART:19920415T133000Z DUE:19920516T045959Z -SUMMARY:Status is set to COMPLETED, empty URL -CLASS:CONFIDENTIAL +SUMMARY:Status is set to COMPLETED, empty URL, CLASS set +CLASS:PUBLIC CATEGORIES:FAMILY,FINANCE STATUS:COMPLETED URL: @@ -30,10 +30,9 @@ BEGIN:VTODO UID:19920901T130000Z-123408@host.com DTSTAMP:19920901T130000Z DTSTART:19920415T133000Z -SUMMARY:Status is IN-PROCESS, URL is set +SUMMARY:Status is IN-PROCESS, URL is set, CLASS isn't set STATUS:IN-PROCESS URL:https://www.davical.org -CLASS:CONFIDENTIAL CATEGORIES:FAMILY,FINANCE PRIORITY:1 END:VTODO diff --git a/testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.result b/testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.result new file mode 100644 index 00000000..09318d02 --- /dev/null +++ b/testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.result @@ -0,0 +1,62 @@ +HTTP/1.1 207 Multi-Status +Date: Dow, 01 Jan 2000 00:00:00 GMT +DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule +DAV: extended-mkcol, bind, addressbook, calendar-auto-schedule, calendar-proxy +ETag: "c073b3f2dd8d609971aaafee83aa4002" +Content-Length: 1321 +Content-Type: text/xml; charset="utf-8" + + + + + /caldav.php/user1/events/19970901T130000Z-123405host.com.ics + + + BEGIN:VCALENDAR +PRODID:-//davical.org//NONSGML AWL Calendar//EN +VERSION:2.0 +CALSCALE:GREGORIAN +BEGIN:VTODO +UID:19970901T130000Z-123405@host.com +DTSTAMP:19970901T130000Z +DTSTART:19970415T133000Z +DUE:19970516T045959Z +SUMMARY:Status is not set +CLASS:CONFIDENTIAL +CATEGORIES:FAMILY,FINANCE +PRIORITY:1 +END:VTODO +END:VCALENDAR + + + HTTP/1.1 200 OK + + + + /caldav.php/user1/events/19920901T130000Z-123407host.com.ics + + + BEGIN:VCALENDAR +PRODID:-//davical.org//NONSGML AWL Calendar//EN +VERSION:2.0 +CALSCALE:GREGORIAN +BEGIN:VTODO +UID:19920901T130000Z-123407@host.com +DTSTAMP:19920901T130000Z +DTSTART:19920415T133000Z +DUE:19920516T045959Z +SUMMARY:Status is set to COMPLETED, empty URL, CLASS set +CLASS:PUBLIC +CATEGORIES:FAMILY,FINANCE +STATUS:COMPLETED +URL: +COMPLETED:19940101T000000Z +PRIORITY:1 +END:VTODO +END:VCALENDAR + + + HTTP/1.1 200 OK + + + diff --git a/testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.test b/testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.test new file mode 100644 index 00000000..9d01ff61 --- /dev/null +++ b/testing/tests/regression-suite/2507-is-defined-REPORT-is-defined-CLASS.test @@ -0,0 +1,33 @@ +# +# is-defined REPORT +# +# Regression test for https://gitlab.com/davical-project/davical/-/issues/279 +# +# Check that CLASS is defined. +# +TYPE=REPORT +URL=http://regression.host/caldav.php/user1/events/ +HEADER=Content-Type: text/xml; charset="UTF-8" +HEADER=Depth: 0 +HEAD + + +BEGINDATA + + + + + + + + + + + + + + + +ENDDATA + + diff --git a/testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.result b/testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.result new file mode 100644 index 00000000..e15e5d4f --- /dev/null +++ b/testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.result @@ -0,0 +1,35 @@ +HTTP/1.1 207 Multi-Status +Date: Dow, 01 Jan 2000 00:00:00 GMT +DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule +DAV: extended-mkcol, bind, addressbook, calendar-auto-schedule, calendar-proxy +ETag: "b9f1d001b8dd22ce62bf8e98c0bbca20" +Content-Length: 721 +Content-Type: text/xml; charset="utf-8" + + + + + /caldav.php/user1/events/19920901T130000Z-123408host.com.ics + + + BEGIN:VCALENDAR +PRODID:-//davical.org//NONSGML AWL Calendar//EN +VERSION:2.0 +CALSCALE:GREGORIAN +BEGIN:VTODO +UID:19920901T130000Z-123408@host.com +DTSTAMP:19920901T130000Z +DTSTART:19920415T133000Z +SUMMARY:Status is IN-PROCESS, URL is set, CLASS isn't set +STATUS:IN-PROCESS +URL:https://www.davical.org +CATEGORIES:FAMILY,FINANCE +PRIORITY:1 +END:VTODO +END:VCALENDAR + + + HTTP/1.1 200 OK + + + diff --git a/testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.test b/testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.test new file mode 100644 index 00000000..7dbca04a --- /dev/null +++ b/testing/tests/regression-suite/2508-is-defined-REPORT-is-not-defined-CLASS.test @@ -0,0 +1,33 @@ +# +# is-not-defined REPORT +# +# Regression test for https://gitlab.com/davical-project/davical/-/issues/279 +# +# Check that CLASS is not defined. +# +TYPE=REPORT +URL=http://regression.host/caldav.php/user1/events/ +HEADER=Content-Type: text/xml; charset="UTF-8" +HEADER=Depth: 0 +HEAD + + +BEGINDATA + + + + + + + + + + + + + + + +ENDDATA + +