diff --git a/inc/caldav-PROPPATCH.php b/inc/caldav-PROPPATCH.php index 9c187092..381e3c45 100644 --- a/inc/caldav-PROPPATCH.php +++ b/inc/caldav-PROPPATCH.php @@ -14,8 +14,11 @@ require_once('iCalendar.php'); require_once('DAVResource.php'); $dav_resource = new DAVResource($request->path); -if ( ! ($dav_resource->HavePrivilegeTo('DAV::write-properties') ) ) { - $request->DoResponse( 403 ); +if ( !$dav_resource->HavePrivilegeTo('DAV::write-properties') ) { + $parent = $dav_resource->GetParentContainer(); + if ( !$dav_resource->IsBinding() || !$parent->HavePrivilegeTo('DAV::write') ) { + $request->PreconditionFailed(403, 'DAV::write-properties', 'You do not have permission to write properties to that resource' ); + } } $position = 0; @@ -24,7 +27,7 @@ $xmltree = BuildXMLTree( $request->xml_tags, $position); // echo $xmltree->Render(); if ( $xmltree->GetTag() != "DAV::propertyupdate" ) { - $request->DoResponse( 403 ); + $request->PreconditionFailed( 403, 'DAV::propertyupdate', 'XML request did not contain a <propertyupdate> tag' ); } /** diff --git a/testing/tests/binding/1033-PROPPATCH-admin-bound.result b/testing/tests/binding/1033-PROPPATCH-admin-bound.result index 9b4986c5..3579de1f 100644 --- a/testing/tests/binding/1033-PROPPATCH-admin-bound.result +++ b/testing/tests/binding/1033-PROPPATCH-admin-bound.result @@ -1,7 +1,7 @@ HTTP/1.1 200 OK Date: Dow, 01 Jan 2000 00:00:00 GMT DAV: 1, 2, 3, access-control, calendar-access, calendar-schedule -DAV: extended-mkcol, calendar-proxy, bind, addressbook +DAV: extended-mkcol, calendar-proxy, bind, addressbook, calendar-auto-schedule Content-Length: 230 Content-Type: text/xml; charset="utf-8"