From 94617522a74362c2470b154ba428ff075d136cd0 Mon Sep 17 00:00:00 2001
From: Andrew McMillan <debian@mcmillan.net.nz>
Date: Thu, 9 Nov 2006 14:33:29 +1300
Subject: [PATCH] Ensure that permissions and path prefixes are being correctly
 applied.

---
 inc/caldav-PROPFIND.php |  9 +++++++++
 inc/caldav-REPORT.php   | 19 ++++++++++++++-----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/inc/caldav-PROPFIND.php b/inc/caldav-PROPFIND.php
index 62a76e62..8e3086c5 100644
--- a/inc/caldav-PROPFIND.php
+++ b/inc/caldav-PROPFIND.php
@@ -10,6 +10,15 @@
 */
 dbg_error_log("PROPFIND", "method handler");
 
+if ( ! isset($permissions['read']) ) {
+  header("HTTP/1.1 403 Forbidden");
+  header("Content-type: text/plain");
+  echo "You may not access that calendar.";
+  dbg_error_log("GET", "Access denied for User: %d, Path: %s", $session->user_no, $request_path);
+  return;
+}
+
+
 require_once("XMLElement.php");
 require_once("iCalendar.php");
 
diff --git a/inc/caldav-REPORT.php b/inc/caldav-REPORT.php
index 19c51953..caf74fa3 100644
--- a/inc/caldav-REPORT.php
+++ b/inc/caldav-REPORT.php
@@ -10,6 +10,15 @@
 */
 dbg_error_log("REPORT", "method handler");
 
+if ( ! isset($permissions['read']) ) {
+  header("HTTP/1.1 403 Forbidden");
+  header("Content-type: text/plain");
+  echo "You may not access that calendar.";
+  dbg_error_log("GET", "Access denied for User: %d, Path: %s", $session->user_no, $request_path);
+  return;
+}
+
+
 require_once("XMLElement.php");
 
 $reportnum = -1;
@@ -230,11 +239,11 @@ else {
 //    dbg_error_log("REPORT", "Report[%d] Start:%s, End: %s, Events: %d, Todos: %d, Freebusy: %d",
 //         $i, $report[$i]['start'], $report[$i]['end'], $report[$i]['filters']['VEVENT'], $report[$i]['filters']['VTODO'], $report[$i]['filters']['VFREEBUSY']);
 
-    $where = "";
+    $where .= " WHERE caldav_data.dav_name ~ ".qpg("^".$request_path)." ";
     switch( $report[$i]['type'] ) {
       case 'CALENDAR-QUERY':
         if ( isset( $report[$i]['start'] ) ) {
-          $where = "AND (dtend >= ".qpg($report[$i]['start'])."::timestamp with time zone ";
+          $where .= "AND (dtend >= ".qpg($report[$i]['start'])."::timestamp with time zone ";
           $where .= "OR calculate_later_timestamp(".qpg($report[$i]['start'])."::timestamp with time zone,dtend,rrule) >= ".qpg($report[$i]['start'])."::timestamp with time zone) ";
         }
         if ( isset( $report[$i]['end'] ) ) {
@@ -270,9 +279,9 @@ else {
     if ( $type_filters != '' ) {
       $where .= " AND caldav_data.caldav_type IN ( $type_filters ) ";
     }
-    if ( $where != '' ) {
-      $where = preg_replace( '#^\s*(AND|OR) #i', ' WHERE ', $where);
-    }
+//    if ( $where != '' ) {
+//      $where = preg_replace( '#^\s*(AND|OR) #i', ' WHERE ', $where);
+//    }
 
     $qry = new PgQuery( "SELECT * FROM caldav_data INNER JOIN calendar_item USING(user_no, dav_name)". $where );
     if ( $qry->Exec("REPORT",__LINE__,__FILE__) && $qry->rows > 0 ) {