nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-11-03 10:10:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Return 403 instead of 500 for a vCard read with only read-free-busy

Browse Source 
A user who holds only read-free-busy on another user's address book got
HTTP 500 for a GET or HEAD of one of its vCards. caldav-GET.php builds an
obfuscated "Busy" copy for readers without DAV::read, but a vCard has no
calendar component, so obfuscated_event() received null and called
GetType() on it.

Free/busy access has nothing to show for a vCard, so refuse it with
403 Forbidden, as PROPFIND of the same address book already does.

Closes #343
This commit is contained in:
Andreas Haerter 2026-10-19 00:25:23 +02:00
parent e990c2edcb
commit f69cac4936
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
inc/caldav-GET.php
View File

@ -54,6 +54,10 @@ if ( $dav_resource->HavePrivilegeTo('all', false) || $session->user_no == $resou
else if ( $resource->class != 'PRIVATE' ) {
$allowed = true; // but we may well obfuscate it below
if ( ! $dav_resource->HavePrivilegeTo('DAV::read') || ( $resource->class == 'CONFIDENTIAL' && ! $request->HavePrivilegeTo('DAV::write-content') ) ) {
if ( $resource->caldav_type == 'VCARD' ) {
// Free/busy access covers calendar data only; a vCard has no busy time to show.
$request->DoResponse( 403, translate("Forbidden") );
}
$ical = new iCalComponent( $resource->caldav_data );
$comps = $ical->GetComponents('VTIMEZONE',false);
$confidential = obfuscated_event($comps[0]);