From da6e9a07e27ec6b91bd246a83c53b49a815129c0 Mon Sep 17 00:00:00 2001
From: Andrew McMillan <andrew@morphoss.com>
Date: Fri, 5 Mar 2010 12:18:09 +1300
Subject: [PATCH] Check XML is present, and also do need-privileges response.

---
 inc/caldav-LOCK.php | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/inc/caldav-LOCK.php b/inc/caldav-LOCK.php
index caead4e8..b57fa98d 100644
--- a/inc/caldav-LOCK.php
+++ b/inc/caldav-LOCK.php
@@ -3,11 +3,23 @@
 * We support both LOCK and UNLOCK methods in this function
 */
 
+require_once('XMLDocument.php');
+$reply = new XMLDocument(array( 'DAV:' => '' ));
+
 if ( ! $request->AllowedTo('write') ) {
-  $request->DoResponse( 403, translate("You do not have sufficient access to lock that") );
+  $request->NeedPrivilege( 'write', $request->path );
+}
+
+if ( ! isset($request->xml_tags) ) {
+  if ( isset($request->lock_token) ) {
+    // It's OK for LOCK refresh requests to be empty.
+    $request->xml_tags = array();
+  }
+  else {
+    $request->XMLResponse( 400, new XMLElement( 'error', new XMLElement('missing-xml-for-request'), $reply->GetXmlNsArray() ) );
+  }
 }
 
-require_once("XMLElement.php");
 
 $unsupported = array();
 $lockinfo = array();