diff --git a/inc/caldav-DELETE.php b/inc/caldav-DELETE.php index a4a36eaa..06ffbde2 100644 --- a/inc/caldav-DELETE.php +++ b/inc/caldav-DELETE.php @@ -1,35 +1,60 @@ user_no, $get_path ); -if ( $qry->Exec("caldav-DELETE") && $qry->rows == 1 ) { - $qry = new PgQuery( "DELETE FROM caldav_data WHERE user_no = ? AND dav_name = ? $only_this_etag;", $session->user_no, $get_path ); - if ( $qry->Exec("caldav-DELETE") ) { - header("HTTP/1.1 200 OK"); - dbg_error_log( "delete", "DELETE: User: %d, ETag: %s, Path: %s", $session->user_no, $etag_none_match, $get_path); + +if ( !isset($permissions['write']) ) { + header("HTTP/1.1 403 Forbidden"); + header("Content-type: text/plain"); + if ( isset($etag_none_match) && $etag_none_match == $delete_row->dav_etag ) { + echo "Permission denied"; + } + exit(0); +} + +/** +* Wr read the resource first, so we can check if it matches (or does not match) +*/ +$qry = new PgQuery( "SELECT * FROM caldav_data WHERE user_no = ? AND dav_name = ?;", (isset($path_user_no)?$path_user_no:$session->user_no), $request_path ); +if ( $qry->Exec("DELETE") && $qry->rows == 1 ) { + $delete_row = $qry->Fetch(); + if ( (isset($etag_none_match) && $etag_none_match == $delete_row->dav_etag) || (isset($etag_if_match) && $etag_if_match != $delete_row->dav_etag) ) { + header("HTTP/1.1 412 Precondition Failed"); + header("Content-type: text/plain"); + if ( isset($etag_none_match) && $etag_none_match == $delete_row->dav_etag ) { + echo "Resource matches 'If-None-Match' header - not deleted\n"; + } + if ( isset($etag_if_match) && $etag_if_match != $delete_row->dav_etag ) { + echo "Resource does not match 'If-Match' header - not deleted\n"; + } + exit(0); + } + $qry = new PgQuery( "DELETE FROM caldav_data WHERE user_no = ? AND dav_name = ? $only_this_etag;", $session->user_no, $request_path ); + if ( $qry->Exec("DELETE") ) { + header("HTTP/1.1 200 Deleted", true, 200); + header("Content-length: 0"); + dbg_error_log( "DELETE", "DELETE: User: %d, ETag: %s, Path: %s", $session->user_no, $etag_none_match, $request_path); } else { header("HTTP/1.1 500 Infernal Server Error"); - dbg_error_log( "delete", "DELETE failed: User: %d, ETag: %s, Path: %s, SQL: %s", $session->user_no, $etag_none_match, $get_path, $qry->querystring); + dbg_error_log( "DELETE", "DELETE failed: User: %d, ETag: %s, Path: %s, SQL: %s", $session->user_no, $etag_none_match, $request_path, $qry->querystring); } } else { header("HTTP/1.1 404 Not Found"); - dbg_error_log( "delete", "DELETE row not found: User: %d, ETag: %s, Path: %s", $qry->rows, $session->user_no, $etag_none_match, $get_path); + dbg_error_log( "DELETE", "DELETE row not found: User: %d, ETag: %s, Path: %s", $qry->rows, $session->user_no, $etag_none_match, $request_path); } ?> \ No newline at end of file