nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-09-01 18:48:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix PROPPATCH behaviour on bound resources.

Browse Source 
It is OK to modify dead properties on a bound resource as long as you
have permission on the folder containing the binding.  For active
properties we have special logic for modifying the displayname but all
others are refused.
This commit is contained in:
Andrew McMillan 2011-09-08 08:42:18 +12:00
parent 5665f5b2e8
commit 7a37beff80
2 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
inc/caldav-PROPPATCH.php
View File

@ -14,8 +14,11 @@ require_once('iCalendar.php');
require_once('DAVResource.php');
$dav_resource = new DAVResource($request->path);
if ( ! ($dav_resource->HavePrivilegeTo('DAV::write-properties') ) ) {
$request->DoResponse( 403 );
if ( !$dav_resource->HavePrivilegeTo('DAV::write-properties') ) {
$parent = $dav_resource->GetParentContainer();
if ( !$dav_resource->IsBinding() || !$parent->HavePrivilegeTo('DAV::write') ) {
$request->PreconditionFailed(403, 'DAV::write-properties', 'You do not have permission to write properties to that resource' );
}
}
$position = 0;
@ -24,7 +27,7 @@ $xmltree = BuildXMLTree( $request->xml_tags, $position);
// echo $xmltree->Render();
if ( $xmltree->GetTag() != "DAV::propertyupdate" ) {
$request->DoResponse( 403 );
$request->PreconditionFailed( 403, 'DAV::propertyupdate', 'XML request did not contain a <propertyupdate> tag' );
}
/**

2
testing/tests/binding/1033-PROPPATCH-admin-bound.result
View File

@ -1,7 +1,7 @@
HTTP/1.1 200 OK
Date: Dow, 01 Jan 2000 00:00:00 GMT
DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule
DAV: extended-mkcol, calendar-proxy, bind, addressbook
DAV: extended-mkcol, calendar-proxy, bind, addressbook, calendar-auto-schedule
Content-Length: 230
Content-Type: text/xml; charset="utf-8"