nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-11-01 09:49:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'fix-vcard-read-free-busy-403' into 'master'

Browse Source 
Return 403 instead of 500 for a vCard read with only read-free-busy

See merge request davical-project/davical!152
This commit is contained in:
Andreas Haerter 2026-10-18 22:26:16 +00:00
commit 48488567e5
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
inc/caldav-GET.php
View File

@ -54,6 +54,10 @@ if ( $dav_resource->HavePrivilegeTo('all', false) || $session->user_no == $resou
else if ( $resource->class != 'PRIVATE' ) {
$allowed = true; // but we may well obfuscate it below
if ( ! $dav_resource->HavePrivilegeTo('DAV::read') || ( $resource->class == 'CONFIDENTIAL' && ! $request->HavePrivilegeTo('DAV::write-content') ) ) {
if ( $resource->caldav_type == 'VCARD' ) {
// Free/busy access covers calendar data only; a vCard has no busy time to show.
$request->DoResponse( 403, translate("Forbidden") );
}
$ical = new iCalComponent( $resource->caldav_data );
$comps = $ical->GetComponents('VTIMEZONE',false);
$confidential = obfuscated_event($comps[0]);