Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(caldav): Do not load IMipPlugin before user auth and session is c… #45098

Merged
merged 5 commits into from
May 4, 2024
Merged

fix(caldav): Do not load IMipPlugin before user auth and session is c… #45098

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9859a44
fix(caldav): Do not load IMipPlugin before user auth and session is c…
SebastianKrupinski Apr 29, 2024
f44b73e
fix(caldav): Use userSession instead of userId
SebastianKrupinski Apr 30, 2024
d25039e
fix(caldav): Test if user object is not null and trim senderName
SebastianKrupinski May 1, 2024
2088b49
fix(caldav): Fixed phpUnit to use userSession instead of userId and u…
SebastianKrupinski May 2, 2024
51d338b
fix(caldav): Fixed formatting to comply with php-cs
SebastianKrupinski May 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
30 changes: 13 additions & 17 deletions apps/dav/lib/CalDAV/Schedule/IMipPlugin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\Defaults;
use OCP\IConfig;
use OCP\IUserManager;
use OCP\IUserSession;
use OCP\Mail\IMailer;
use OCP\Util;
use Psr\Log\LoggerInterface;
Expand Down Expand Up @@ -69,13 +69,12 @@
* @license http://sabre.io/license/ Modified BSD License
*/
class IMipPlugin extends SabreIMipPlugin {
private ?string $userId;
private IUserSession $userSession;
private IConfig $config;
private IMailer $mailer;
private LoggerInterface $logger;
private ITimeFactory $timeFactory;
private Defaults $defaults;
private IUserManager $userManager;
private ?VCalendar $vCalendar = null;
private IMipService $imipService;
public const MAX_DATE = '2038-01-01';
Expand All @@ -90,18 +89,16 @@
LoggerInterface $logger,
ITimeFactory $timeFactory,
Defaults $defaults,
IUserManager $userManager,
$userId,
IUserSession $userSession,
IMipService $imipService,
EventComparisonService $eventComparisonService) {
parent::__construct('');
$this->userId = $userId;
$this->userSession = $userSession;
$this->config = $config;
$this->mailer = $mailer;
$this->logger = $logger;
$this->timeFactory = $timeFactory;
$this->defaults = $defaults;
$this->userManager = $userManager;
$this->imipService = $imipService;
$this->eventComparisonService = $eventComparisonService;
}
Expand Down Expand Up @@ -206,17 +203,16 @@
$this->imipService->setL10n($attendee);

// Build the sender name.
// Due to a bug in sabre, the senderName property for an iTIP message
// can actually also be a VObject Property
/** @var Parameter|string|null $senderName */
$senderName = $iTipMessage->senderName ?: null;
if($senderName instanceof Parameter) {
$senderName = $senderName->getValue() ?? null;
// Due to a bug in sabre, the senderName property for an iTIP message can actually also be a VObject Property
// If the iTIP message senderName is null or empty use the user session name as the senderName
if (($iTipMessage->senderName instanceof Parameter) && !empty(trim($iTipMessage->senderName->getValue()))) {

Check notice

Code scanning / Psalm

PossiblyNullArgument Note

Argument 1 of trim cannot be null, possibly null value provided
$senderName = $iTipMessage->senderName->getValue();
}

// Try to get the sender name from the current user id if available.
if ($this->userId !== null && ($senderName === null || empty(trim($senderName)))) {
$senderName = $this->userManager->getDisplayName($this->userId);
elseif (is_string($iTipMessage->senderName) && !empty(trim($iTipMessage->senderName))) {
$senderName = $iTipMessage->senderName;
}
else {
$senderName = $this->userSession->getUser()->getDisplayName();
Fixed Show fixed Hide fixed
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be an opportunity to trim $senderName afterwards for all cases.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even though this should be safe when registered through dav server, it might not be when used through apps/dav/appinfo/v1/caldav.php (very legacy stuff, but still). I'd add a check to see if getUser() isn't null (and psalm would be happy).

}

$sender = substr($iTipMessage->sender, 7);
Expand Down
18 changes: 14 additions & 4 deletions apps/dav/lib/Server.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@
use OCA\DAV\AppInfo\PluginManager;
use OCA\DAV\BulkUpload\BulkUploadPlugin;
use OCA\DAV\CalDAV\BirthdayService;
use OCA\DAV\CalDAV\Schedule\IMipPlugin;
use OCA\DAV\CalDAV\Security\RateLimitingPlugin;
use OCA\DAV\CardDAV\HasPhotoPlugin;
use OCA\DAV\CardDAV\ImageExportPlugin;
Expand Down Expand Up @@ -176,12 +177,10 @@

// calendar plugins
if ($this->requestIsForSubtree(['calendars', 'public-calendars', 'system-calendars', 'principals'])) {
$this->server->addPlugin(new DAV\Sharing\Plugin($authBackend, \OC::$server->getRequest(), \OC::$server->getConfig()));

Check notice

Code scanning / Psalm

DeprecatedMethod Note

The method OC\Server::getRequest has been marked as deprecated

Check notice

Code scanning / Psalm

DeprecatedMethod Note

The method OC\Server::getConfig has been marked as deprecated
$this->server->addPlugin(new \OCA\DAV\CalDAV\Plugin());
$this->server->addPlugin(new \OCA\DAV\CalDAV\ICSExportPlugin\ICSExportPlugin(\OC::$server->getConfig(), $logger));
$this->server->addPlugin(new \OCA\DAV\CalDAV\Schedule\Plugin(\OC::$server->getConfig(), \OC::$server->get(LoggerInterface::class)));
if (\OC::$server->getConfig()->getAppValue('dav', 'sendInvitations', 'yes') === 'yes') {
$this->server->addPlugin(\OC::$server->query(\OCA\DAV\CalDAV\Schedule\IMipPlugin::class));
}

$this->server->addPlugin(\OC::$server->get(\OCA\DAV\CalDAV\Trashbin\Plugin::class));
$this->server->addPlugin(new \OCA\DAV\CalDAV\WebcalCaching\Plugin($request));
Expand All @@ -190,7 +189,6 @@
}

$this->server->addPlugin(new \Sabre\CalDAV\Notifications\Plugin());
$this->server->addPlugin(new DAV\Sharing\Plugin($authBackend, \OC::$server->getRequest(), \OC::$server->getConfig()));
$this->server->addPlugin(new \OCA\DAV\CalDAV\Publishing\PublishPlugin(
\OC::$server->getConfig(),
\OC::$server->getURLGenerator()
Expand Down Expand Up @@ -304,6 +302,18 @@
\OC::$server->getCommentsManager(),
$userSession
));
if (\OC::$server->getConfig()->getAppValue('dav', 'sendInvitations', 'yes') === 'yes') {

Check notice

Code scanning / Psalm

DeprecatedMethod Note

The method OC\Server::getConfig has been marked as deprecated

Check notice

Code scanning / Psalm

DeprecatedMethod Note

The method OCP\IConfig::getAppValue has been marked as deprecated
$this->server->addPlugin(new IMipPlugin(
\OC::$server->get(\OCP\IConfig::class),
\OC::$server->get(\OCP\Mail\IMailer::class),
\OC::$server->get(LoggerInterface::class),
\OC::$server->get(\OCP\AppFramework\Utility\ITimeFactory::class),
\OC::$server->get(\OCP\Defaults::class),
$userSession,
\OC::$server->get(\OCA\DAV\CalDAV\Schedule\IMipService::class),
\OC::$server->get(\OCA\DAV\CalDAV\EventComparisonService::class)
));
}
$this->server->addPlugin(new \OCA\DAV\CalDAV\Search\SearchPlugin());
if ($view !== null) {
$this->server->addPlugin(new FilesReportPlugin(
Expand Down