nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-09-19 05:59:02 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
3,884 Commits 11 Branches 63 Tags 15 MiB
Commit Graph

109 Commits

Author SHA1 Message Date
Andrew Ruthven
39d0cd5837 Don't change passwords to $pwstars 
The password input boxes are supposed to contain the value of $pwstars,
not the string '$pwstars'.
 2024-01-21 13:34:30 +13:00
Andrew Ruthven
e8f3a3e6f2 Add a missing space to a SQL statement to fix adding groups. 
It looks to me like this bug has been present since 2011.

Closes: #294
 2023-04-30 12:13:37 +12:00
Piotr Filip
13c77fdcab check owner when deleting 2023-03-01 21:29:44 +01:00
Piotr Filip
f29af80116 delete collection by id 2022-12-13 00:30:27 +00:00
Piotr Filip
35641b099a refactor scripts to allow operation with Content-Security-Policy: script-src 'self' 2022-12-12 21:32:57 +00:00
Andrew Ruthven
0913f8ca69 Fix another PHP 8.1 error 2022-02-18 23:11:50 +13:00
Paul Waite
dd5bd9c282 Provide a facility for setting an override URL which will replace the Change Password UI, and the Forgotten Password UI with a clickable link. 2022-02-12 14:02:54 +00:00
Andrew Ruthven
c26ad777a2 We need $privilege_names in the list of globals. 
Closes #250. Thank you to Laurent Hoareau and Jos Alsters.
 2021-09-19 02:56:19 +12:00
Florian Schlichting
e92e981542 Listing External Calendars is part of the Administration menu and should be restricted to admins 
this could be made configurable, or lumped in with
$c->restrict_setup_to_admin, but non-admins only get here by manually
entering the URL...
 2021-02-09 01:54:32 +08:00
Florian Schlichting
202e2edd5a tighten $c->list_everyone to look for DAV::read privilege and actually block access to principals and collections 
Groups really only exist in the davical web interface, CALDAV clients
discover principals and collections based on GRANTs such as the
DAV::read privilege, so use that for the web interface as well.

Also, not listing users is nice, actually blocking access to those users
(which can be enumerated with the id GET parameter) is a lot better.
 2021-02-09 01:54:32 +08:00
Klaus M Pfeiffer
042ce5f076 add feature list_everyone (fixes #59) 2021-02-08 17:41:28 +00:00
nielsvangijzen
c8a0ca4531 Fix CSRF not being checked in collection-edit.php 2019-12-06 09:30:16 +01:00
nielsvangijzen
1a917b30eb Addressed comments made by @puck42 2019-11-29 09:58:46 +01:00
nielsvangijzen
86a8ec5302 Added CSRF to the application (took in account backwards compatibility) 
Mitigated the XSS vulnerabilities reported by HackDefense
Advisories for said vulnerabilities can be found here:
https://hackdefense.com/publications/cve-2019-18345-davical-caldav-server-vulnerability
https://hackdefense.com/publications/cve-2019-18346-davical-caldav-server-vulnerability
https://hackdefense.com/publications/cve-2019-18347-davical-caldav-server-vulnerability
 2019-10-28 11:55:11 +01:00
Jamie McClymont
fe443bf2e6 Update instance range columns when a collection's timezone changes 
TODO: Handle the case where it is updated through the web UI
 2019-01-08 14:09:16 +13:00
Florian Schlichting
19eb79ebf9 provide defaults for unused function parameters (fixes #155) 
PHP 7.1 throws an exception when a user-defined function is called with
too few arguments: http://php.net/manual/en/migration71.incompatible.php

As explained in the comments, collection_privilege_format_function and
principal_privilege_format_function take three arguments because of
their use as a rendering callback, however the latter two of them are
never used and thus can be ommitted in other uses.
 2018-12-29 19:38:13 +01:00
Florian Schlichting
50a29d96ab UI: create external bindings with type set (fix: #132) 2018-01-03 00:57:05 +01:00
Scott Balneaves
8313f765ce Only list active principals in grant selection 
modified as per Andrew McMillan's suggestion
 2017-04-07 15:09:53 +02:00
Florian Schlichting
2a84694331 Unbreak locale selection in admin interface 
http://php.net/manual/en/function.setlocale.php says "Different systems
have different naming schemes for locales." This seems to be true for
platforms (eg Win vs. Linux), but on Debian AFAIR locales were always at
least two-part (de_DE), never just one (de). This seems to have been
broken in 504651a3, likely by mistake.

Also, switch locale immediately, even before writing to the database.

BTW, what happens when system default locale is configured to e.g. fr_FR
and the user selects "English" - does that work?
 2017-01-17 23:40:26 +01:00
Florian Schlichting
1335a6117b UI: create internal and external bindings (closes: #90) 2017-01-11 00:13:52 +01:00
Florian Schlichting
0ca04aaa68 UI: do not show tickets unless user has write access; they are like passwords 
Same with external URLs

Also restrict Delete buttons on incoming binds to Admins: these binds
will usually live in other people's namespace, which we should not
alter, and may be restricted to default privileges (e.g. freebusy)
anyway
 2017-01-11 00:10:21 +01:00
Florian Schlichting
ab7dad057d UI: use ExtraRowFormat to fix tooltip on action rows / buttons 2017-01-10 22:14:42 +01:00
Florian Schlichting
4d689f8539 Create configured default relationships from all drivers as well as for internal auth (closes: #75) 
previously, this was only usable with the LDAP driver
 2017-01-06 16:06:11 +01:00
Florian Schlichting
adce3f48a9 provide a .ics download link in collection view and document $c->get_includes_subcollections 2017-01-02 21:57:41 +01:00
Florian Schlichting
fc78600e64 Allow deletion of collections, tickets, bindings of principals to whom you have write access (closes: #47) 
Previously, only the Admin or the principal herself could delete a
collection. Deletion is immediate and irreversible, so there is a risk
in allowing this. But it doesn't make sense to allow the creation of a
test collection and then block the subsequent clean-up.
 2016-12-30 21:43:29 +01:00
Florian Schlichting
c0a2d6a7ee do not show edit buttons on admin pages when not allowed to edit 2016-12-30 18:47:46 +01:00
Florian Schlichting
fcace79813 display an error message when not allowed to delete something on the admin page 2016-12-30 16:25:53 +01:00
Florian Schlichting
f24c62531a inc/ui/collection-edit.php: display only privileges applicable for collections 2016-12-30 08:54:28 +01:00
Florian Schlichting
404d9ab449 fix remaining apigen errors (duplicate function names etc) 2016-12-30 08:54:24 +01:00
Florian Schlichting
eb7f2edc0c eliminate trailing whitespace, expand tabs 2016-12-30 08:52:44 +01:00
Florian Schlichting
3d886ce139 email addresses must be unique: add a tooltip and a warning message (fixes #30) 2015-12-31 18:37:12 +01:00
Florian Schlichting
38673060a1 Make "Toggle all privileges" button work on all forms 2015-12-16 00:08:21 +01:00
Jason Alavaliant
72dc5b1f39 fix the append box when importing collections 2013-09-02 15:02:47 +12:00
Christoph Anton Mitterer
8e60bb3124 set line endings of most text files to LF 
* Changed the end-of-line encodings of all non-Windows-related and non-autogenerated text files to use UNIX LF (lots of them had mixed LF/CRLF).

Conflicts:
	inc/caldav-PUT-functions.php
 2013-09-02 14:37:23 +12:00
Andrew McMillan
ec3996bca7 Decide whether we can write the principal before we refer to it... 2012-06-14 21:16:13 +12:00
Andrew McMillan
d1c2179bbb Allow a user delegated write access to the principal to maintain it. 2012-06-11 19:43:05 +12:00
Andrew McMillan
98fe8a9e19 Don't disable upload field. Use library to create 'append mode' field. 2012-05-15 00:21:35 +12:00
Andrew McMillan
b8b72d8470 Fix bug in "Edit" of existing grant. 2012-04-18 16:50:58 +12:00
Andrew McMillan
f3b1f7fe98 Make the 'append' option work. 2012-01-30 22:25:02 -08:00
Andrew McMillan
e05253327f Set the default URL to the default calendar name rather than /home/ 2012-01-13 17:34:40 +13:00
Andrew McMillan
2b26ca7d25 Enable the file upload for addressbook collections. 2012-01-13 17:34:11 +13:00
Andrew McMillan
23d454a6d0 The tooltips for schedule-send and schedule-deliver should be different! 2011-11-21 10:54:57 +13:00
Rob Ostensen
2de1327934 more external bind changes, added a clean up button, urls now show for external collections and added a few strings for translation 2011-10-24 21:18:04 +13:00
Andrew McMillan
5067d50215 Fix comment. 2011-10-10 13:48:05 +02:00
Rob Ostensen
7f3024a4b6 add a page to list externally bound calendars, still missing the edit page and a button to remove dangling entries 2011-10-07 09:46:31 +02:00
Andrew McMillan
2127c294a3 Various small fixes preparing for release. 
Correct logic for auto-creating addressbook for new user.
Fix non-creation of default addressbook.
Fix principal/collection edit to allow write of no privileges.
Fix collection edit timezone list to use new table.
Update davical & libawl version in always.php.
Regression test changes with update to davical.sql.
 2011-09-25 22:29:31 +13:00
Andrew McMillan
b901981c7c Fix calendar-query handling of properties. 2011-08-24 20:38:32 +12:00
Andrew McMillan
62d5881bd0 Fix sort order of members listed in a group. 
Signed-off-by: Andrew McMillan <andrew@morphoss.com>
 2011-02-23 12:16:16 +13:00
Andrew McMillan
fcd2ffc5b3 Fix function rename so we can create tickets. 
Signed-off-by: Andrew McMillan <andrew@morphoss.com>
 2011-01-15 16:43:15 +13:00
Andrew McMillan
bb1e22c9b5 We need access to $c here... 
Signed-off-by: Andrew McMillan <andrew@morphoss.com>
 2011-01-07 00:09:06 +13:00