Skip to content
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Properly validate hex colors
Signed-off-by: Julius Härtl <[email protected]>
  • Loading branch information
juliusknorr committed Sep 11, 2020
commit c2a4f946b419ea4fc1d2f361a652d59fcec6734f
7 changes: 6 additions & 1 deletion lib/DAV/Calendar.php
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
use Sabre\DAV\Exception\Forbidden;
use Sabre\DAV\Exception\NotFound;
use Sabre\DAV\PropPatch;
use Sabre\VObject\InvalidDataException;

class Calendar extends ExternalCalendar {

Expand Down Expand Up @@ -164,7 +165,11 @@ public function propPatch(PropPatch $propPatch) {
$this->board->setTitle($value);
break;
case '{http://apple.com/ns/ical/}calendar-color':
$this->board->setColor(substr($value, 1));
$color = substr($value, 1, 6);
if (!preg_match('/[a-f0-9]{6}/i', $color)) {
throw new InvalidDataException('No valid color provided');
}
$this->board->setColor($color);
break;
}
}
Expand Down