From 81072fc8ed3f676396255dbaa20660cc1d9fd123 Mon Sep 17 00:00:00 2001
From: Andrew McMillan <andrew@morphoss.com>
Date: Thu, 22 Mar 2012 14:08:59 +1300
Subject: [PATCH] Better privilege checking on POST scheduling actions.

---
 inc/caldav-POST.php | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/inc/caldav-POST.php b/inc/caldav-POST.php
index 09b09fb4..58323a8b 100644
--- a/inc/caldav-POST.php
+++ b/inc/caldav-POST.php
@@ -15,25 +15,19 @@ include_once('caldav-PUT-functions.php');
 include_once('freebusy-functions.php');
 include_once('iSchedule.php');
 
-if ( ! $request->AllowedTo("CALDAV:schedule-send-freebusy")
-  && ! $request->AllowedTo("CALDAV:schedule-send-invite")
-  && ! $request->AllowedTo("CALDAV:schedule-send-reply") ) {
-  // $request->DoResponse(403);
-  dbg_error_log( "WARN", ": POST: permissions not yet checked" );
-}
-
-if ( ! ini_get('open_basedir') && (isset($c->dbg['ALL']) || isset($c->dbg['post'])) ) {
-  $fh = fopen('/tmp/POST.txt','w');
-  if ( $fh ) {
-    fwrite($fh,$request->raw_post);
-    fclose($fh);
-  }
-}
-
+if ( ! ini_get('open_basedir') && (isset($c->dbg['ALL']) || isset($c->dbg['post'])) ) {
+  $fh = fopen('/tmp/POST.txt','w');
+  if ( $fh ) {
+    fwrite($fh,$request->raw_post);
+    fclose($fh);
+  }
+}
+
 
 function handle_freebusy_request( $ic ) {
   global $c, $session, $request, $ical;
 
+  $request->NeedPrivilege('CALDAV:schedule-send-freebusy');
   $reply = new XMLDocument( array("DAV:" => "", "urn:ietf:params:xml:ns:caldav" => "C" ) );
   $responses = array();
 
@@ -137,6 +131,8 @@ function handle_freebusy_request( $ic ) {
 function handle_cancel_request( $ic ) {
   global $c, $session, $request;
 
+  $request->NeedPrivilege('CALDAV:schedule-send-reply');
+  
   $reply = new XMLDocument( array("DAV:" => "", "urn:ietf:params:xml:ns:caldav" => "C" ) );
 
   $response = $reply->NewXMLElement( "response", false, false, 'urn:ietf:params:xml:ns:caldav' );
@@ -145,6 +141,7 @@ function handle_cancel_request( $ic ) {
   $request->XMLResponse( 200, $response );
 }
 
+
 $ical = new vCalendar( $request->raw_post );
 $method =  $ical->GetPValue('METHOD');
 
@@ -156,6 +153,7 @@ switch ( $method ) {
     if ( $first->GetType() == 'VFREEBUSY' )
       handle_freebusy_request( $first );
     elseif ( $first->GetType() == 'VEVENT' ) {
+      $request->NeedPrivilege('CALDAV:schedule-send-invite');
       handle_schedule_request( $ical );
     }
     else {
@@ -164,6 +162,7 @@ switch ( $method ) {
     break;
   case 'REPLY':
     dbg_error_log('POST', 'Handling iTIP "REPLY" with "%s" component.', $first->GetType() );
+    $request->NeedPrivilege('CALDAV:schedule-send-reply');
     handle_schedule_reply ( $ical );
     break;