fix(caldav): Do not load IMipPlugin before user auth and session is c… #45098
Conversation
…reated Signed-off-by: SebastianKrupinski <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -176,12 +177,10 @@ | |||
|
|
|||
| // calendar plugins | |||
| if ($this->requestIsForSubtree(['calendars', 'public-calendars', 'system-calendars', 'principals'])) { | |||
| $this->server->addPlugin(new DAV\Sharing\Plugin($authBackend, \OC::$server->getRequest(), \OC::$server->getConfig())); | |||
Check notice
Code scanning / Psalm
DeprecatedMethod Note
| @@ -176,12 +177,10 @@ | |||
|
|
|||
| // calendar plugins | |||
| if ($this->requestIsForSubtree(['calendars', 'public-calendars', 'system-calendars', 'principals'])) { | |||
| $this->server->addPlugin(new DAV\Sharing\Plugin($authBackend, \OC::$server->getRequest(), \OC::$server->getConfig())); | |||
Check notice
Code scanning / Psalm
DeprecatedMethod Note
| @@ -304,6 +302,19 @@ | |||
| \OC::$server->getCommentsManager(), | |||
| $userSession | |||
| )); | |||
| if (\OC::$server->getConfig()->getAppValue('dav', 'sendInvitations', 'yes') === 'yes') { | |||
Check notice
Code scanning / Psalm
DeprecatedMethod Note
| @@ -304,6 +302,19 @@ | |||
| \OC::$server->getCommentsManager(), | |||
| $userSession | |||
| )); | |||
| if (\OC::$server->getConfig()->getAppValue('dav', 'sendInvitations', 'yes') === 'yes') { | |||
Check notice
Code scanning / Psalm
DeprecatedMethod Note
Signed-off-by: SebastianKrupinski <[email protected]>
| $senderName = $senderName->getValue() ?? null; | ||
| // Due to a bug in sabre, the senderName property for an iTIP message can actually also be a VObject Property | ||
| // If the iTIP message senderName is null or empty use the user session name as the senderName | ||
| if (($iTipMessage->senderName instanceof Parameter) && !empty(trim($iTipMessage->senderName->getValue()))) { |
Check notice
Code scanning / Psalm
PossiblyNullArgument Note
| $senderName = $iTipMessage->senderName; | ||
| } | ||
| else { | ||
| $senderName = $this->userSession->getUser()->getDisplayName(); |
There was a problem hiding this comment.
Might be an opportunity to trim $senderName afterwards for all cases.
| $senderName = $iTipMessage->senderName; | ||
| } | ||
| else { | ||
| $senderName = $this->userSession->getUser()->getDisplayName(); |
There was a problem hiding this comment.
Even though this should be safe when registered through dav server, it might not be when used through apps/dav/appinfo/v1/caldav.php (very legacy stuff, but still). I'd add a check to see if getUser() isn't null (and psalm would be happy).
|
@tcitworld thank you for the input. I will apply your recommendations. |
Signed-off-by: SebastianKrupinski <[email protected]>
|
|
…serManager Signed-off-by: SebastianKrupinski <[email protected]>
Signed-off-by: SebastianKrupinski <[email protected]>
| // Due to a bug in sabre, the senderName property for an iTIP message can actually also be a VObject Property | ||
| // If the iTIP message senderName is null or empty use the user session name as the senderName | ||
| if (($iTipMessage->senderName instanceof Parameter) && !empty(trim($iTipMessage->senderName->getValue()))) { | ||
| $senderName = trim($iTipMessage->senderName->getValue()); |
Check notice
Code scanning / Psalm
PossiblyNullArgument Note
| } elseif (is_string($iTipMessage->senderName) && !empty(trim($iTipMessage->senderName))) { | ||
| $senderName = trim($iTipMessage->senderName); | ||
| } elseif ($this->userSession->getUser() !== null) { | ||
| $senderName = trim($this->userSession->getUser()->getDisplayName()); |
Check notice
Code scanning / Psalm
PossiblyNullReference Note
|
Thanks for your first pull request and welcome to the community! Feel free to keep them coming! If you are looking for issues to tackle then have a look at this selection: https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22 |
Summary
Do not load IMipPlugin before user is authenticated and user session is initilized