Skip to content

Commit deb8ecc

Browse files
sorbaughsorbaugh
authored
Merge pull request #59964 from nextcloud/backport/59962/stable33
[stable33] fix: add ACLs for calender delegation
2 parents 5886c31 + e750915 commit deb8ecc

7 files changed

Lines changed: 116 additions & 15 deletions

File tree

‎apps/dav/composer/composer/autoload_classmap.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,8 @@
9696
'OCA\\DAV\\CalDAV\\Outbox' => $baseDir . '/../lib/CalDAV/Outbox.php',
9797
'OCA\\DAV\\CalDAV\\Plugin' => $baseDir . '/../lib/CalDAV/Plugin.php',
9898
'OCA\\DAV\\CalDAV\\Principal\\Collection' => $baseDir . '/../lib/CalDAV/Principal/Collection.php',
99+
'OCA\\DAV\\CalDAV\\Principal\\ProxyRead' => $baseDir . '/../lib/CalDAV/Principal/ProxyRead.php',
100+
'OCA\\DAV\\CalDAV\\Principal\\ProxyWrite' => $baseDir . '/../lib/CalDAV/Principal/ProxyWrite.php',
99101
'OCA\\DAV\\CalDAV\\Principal\\User' => $baseDir . '/../lib/CalDAV/Principal/User.php',
100102
'OCA\\DAV\\CalDAV\\Proxy\\Proxy' => $baseDir . '/../lib/CalDAV/Proxy/Proxy.php',
101103
'OCA\\DAV\\CalDAV\\Proxy\\ProxyMapper' => $baseDir . '/../lib/CalDAV/Proxy/ProxyMapper.php',

‎apps/dav/composer/composer/autoload_static.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,8 @@ class ComposerStaticInitDAV
111111
'OCA\\DAV\\CalDAV\\Outbox' => __DIR__ . '/..' . '/../lib/CalDAV/Outbox.php',
112112
'OCA\\DAV\\CalDAV\\Plugin' => __DIR__ . '/..' . '/../lib/CalDAV/Plugin.php',
113113
'OCA\\DAV\\CalDAV\\Principal\\Collection' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/Collection.php',
114+
'OCA\\DAV\\CalDAV\\Principal\\ProxyRead' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/ProxyRead.php',
115+
'OCA\\DAV\\CalDAV\\Principal\\ProxyWrite' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/ProxyWrite.php',
114116
'OCA\\DAV\\CalDAV\\Principal\\User' => __DIR__ . '/..' . '/../lib/CalDAV/Principal/User.php',
115117
'OCA\\DAV\\CalDAV\\Proxy\\Proxy' => __DIR__ . '/..' . '/../lib/CalDAV/Proxy/Proxy.php',
116118
'OCA\\DAV\\CalDAV\\Proxy\\ProxyMapper' => __DIR__ . '/..' . '/../lib/CalDAV/Proxy/ProxyMapper.php',

‎apps/dav/lib/CalDAV/Principal/ProxyRead.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
/**
6+
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
7+
* SPDX-License-Identifier: AGPL-3.0-or-later
8+
*/
9+
10+
namespace OCA\DAV\CalDAV\Principal;
11+
12+
use Sabre\DAVACL;
13+
14+
class ProxyRead extends \Sabre\CalDAV\Principal\ProxyRead implements DAVACL\IACL {
15+
use DAVACL\ACLTrait;
16+
17+
/**
18+
* @inheritDoc
19+
*/
20+
public function getOwner() {
21+
return $this->principalInfo['uri'];
22+
}
23+
}

‎apps/dav/lib/CalDAV/Principal/ProxyWrite.php‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
/**
6+
* SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
7+
* SPDX-License-Identifier: AGPL-3.0-or-later
8+
*/
9+
10+
namespace OCA\DAV\CalDAV\Principal;
11+
12+
use Sabre\DAVACL;
13+
14+
class ProxyWrite extends \Sabre\CalDAV\Principal\ProxyWrite implements DAVACL\IACL {
15+
use DAVACL\ACLTrait;
16+
17+
/**
18+
* @inheritDoc
19+
*/
20+
public function getOwner() {
21+
return $this->principalInfo['uri'];
22+
}
23+
}

‎apps/dav/lib/CalDAV/Principal/User.php‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,4 +34,44 @@ public function getACL() {
3434
];
3535
return $acl;
3636
}
37+
38+
/**
39+
* Returns a specific child node, referenced by its name.
40+
*
41+
* @param string $name
42+
*
43+
* @return \Sabre\DAV\INode
44+
*/
45+
public function getChild($name) {
46+
$principal = $this->principalBackend->getPrincipalByPath($this->getPrincipalURL() . '/' . $name);
47+
if (!$principal) {
48+
throw new \Sabre\DAV\Exception\NotFound("Node with name $name was not found");
49+
}
50+
if ($name === 'calendar-proxy-read') {
51+
return new ProxyRead($this->principalBackend, $this->principalProperties);
52+
}
53+
54+
if ($name === 'calendar-proxy-write') {
55+
return new ProxyWrite($this->principalBackend, $this->principalProperties);
56+
}
57+
58+
throw new \Sabre\DAV\Exception\NotFound("Node with name $name was not found");
59+
}
60+
61+
/**
62+
* Returns an array with all the child nodes.
63+
*
64+
* @return \Sabre\DAV\INode[]
65+
*/
66+
public function getChildren() {
67+
$r = [];
68+
if ($this->principalBackend->getPrincipalByPath($this->getPrincipalURL() . '/calendar-proxy-read')) {
69+
$r[] = new ProxyRead($this->principalBackend, $this->principalProperties);
70+
}
71+
if ($this->principalBackend->getPrincipalByPath($this->getPrincipalURL() . '/calendar-proxy-write')) {
72+
$r[] = new ProxyWrite($this->principalBackend, $this->principalProperties);
73+
}
74+
75+
return $r;
76+
}
3777
}

‎build/integration/dav_features/caldav-delegation.feature‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,11 @@ Feature: calendar delegation
2020
When "admin" updates property "{DAV:}group-member-set" to href "/remote.php/dav/principals/users/user0" of principal "users/admin/calendar-proxy-write" on the endpoint "/remote.php/dav/principals/"
2121
Then The CalDAV response should be multi status
2222
And The CalDAV response should contain an href "/remote.php/dav/principals/users/admin/calendar-proxy-write"
23-
And The CalDAV response should contain a property "{DAV:}group-member-set"
23+
And The CalDAV response should contain a property "{DAV:}group-member-set"
24+
25+
Scenario: Admin cannot grant User1 access to User0's calendar account
26+
Given user "admin" exists
27+
And user "user0" exists
28+
And user "user1" exists
29+
When "admin" updates property "{DAV:}group-member-set" to href "/remote.php/dav/principals/users/user1" of principal "users/user0/calendar-proxy-write" on the endpoint "/remote.php/dav/principals/"
30+
Then The CalDAV HTTP status code should be "404"

‎build/integration/features/bootstrap/CalDavContext.php‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -410,19 +410,23 @@ public function updatesHrefPropertyOfPrincipal(
410410
$xml = new \Sabre\Xml\Service();
411411
$body = $xml->write('{DAV:}propertyupdate', $propPatch, '/');
412412

413-
$this->response = $this->client->request(
414-
'PROPPATCH',
415-
$davUrl,
416-
[
417-
'headers' => [
418-
'Content-Type' => 'application/xml; charset=UTF-8',
419-
],
420-
'body' => $body,
421-
'auth' => [
422-
$user,
423-
$password,
424-
],
425-
]
426-
);
413+
try {
414+
$this->response = $this->client->request(
415+
'PROPPATCH',
416+
$davUrl,
417+
[
418+
'headers' => [
419+
'Content-Type' => 'application/xml; charset=UTF-8',
420+
],
421+
'body' => $body,
422+
'auth' => [
423+
$user,
424+
$password,
425+
],
426+
]
427+
);
428+
} catch (\GuzzleHttp\Exception\ClientException $e) {
429+
$this->response = $e->getResponse();
430+
}
427431
}
428432
}

0 commit comments

Comments
 (0)