nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-11-02 09:59:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

public.php: answer OPTIONS on ancestors of a ticketed collection

Browse Source
This commit is contained in:
Edouard Gaulue 2026-09-15 15:47:04 +02:00
parent e990c2edcb
commit 64d976771e
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
htdocs/public.php
View File

@ -19,6 +19,18 @@ $dav = "1, 2, calendar-access";
header( "DAV: $dav");
require_once("CalDAVRequest.php");
$request = new CalDAVRequest();
// A CalDAV client performing calendar discovery may send an OPTIONS request to
// an ancestor of the ticketed collection (e.g. OPTIONS /user/?ticket=...) to
// probe server capabilities. OPTIONS returns only capability headers, never
// resource data, so answer it whenever a valid ticket is presented, even when
// the ticket scope does not cover that ancestor. Data-bearing methods below
// stay gated by the ticket path check, so no collection contents are exposed.
if ( $request->method == 'OPTIONS'
&& isset($request->ticket) && ! $request->ticket->expired ) {
header('Allow: OPTIONS, GET, HEAD, PROPFIND, REPORT');
$request->DoResponse( 200, '' );
}
if ( ! $request->IsPublic() &&
(! isset($request->ticket)
|| $request->ticket->expired