From 8c5101c1855d27604b3b57e69b460b46c7d24c22 Mon Sep 17 00:00:00 2001 From: Florian Schlichting Date: Mon, 1 May 2017 20:54:03 +0200 Subject: [PATCH] PROPPATCH: reject protected properties group-membership, calendar-proxy-{read,write}-for --- inc/caldav-PROPPATCH.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/inc/caldav-PROPPATCH.php b/inc/caldav-PROPPATCH.php index b25ff156..fb67e5b6 100644 --- a/inc/caldav-PROPPATCH.php +++ b/inc/caldav-PROPPATCH.php @@ -212,6 +212,9 @@ foreach( $setprops AS $k => $setting ) { case 'DAV::creationdate': case 'DAV::lockdiscovery': case 'DAV::supportedlock': + case 'DAV::group-membership': + case 'http://calendarserver.org/ns/:calendar-proxy-read-for': + case 'http://calendarserver.org/ns/:calendar-proxy-write-for': add_failure('set', $tag, 'HTTP/1.1 403 Forbidden', translate("Property is read-only"), 'cannot-modify-protected-property'); break; @@ -264,6 +267,9 @@ foreach( $rmprops AS $k => $setting ) { case 'DAV::displayname': case 'DAV::lockdiscovery': case 'DAV::supportedlock': + case 'DAV::group-membership': + case 'http://calendarserver.org/ns/:calendar-proxy-read-for': + case 'http://calendarserver.org/ns/:calendar-proxy-write-for': add_failure('rm', $tag, 'HTTP/1.1 409 Conflict', translate("Property is read-only")); dbg_error_log( 'PROPPATCH', ' RMProperty %s is read only and cannot be removed', $tag); break;