fix(caldav): Do not load IMipPlugin before user auth and session is c… #45098
Conversation
…reated Signed-off-by: SebastianKrupinski <[email protected]>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| // calendar plugins | ||
| if ($this->requestIsForSubtree(['calendars', 'public-calendars', 'system-calendars', 'principals'])) { | ||
| $this->server->addPlugin(new DAV\Sharing\Plugin($authBackend, \OC::$server->getRequest(), \OC::$server->getConfig())); |
Check notice
Code scanning / Psalm
DeprecatedMethod
|
|
||
| // calendar plugins | ||
| if ($this->requestIsForSubtree(['calendars', 'public-calendars', 'system-calendars', 'principals'])) { | ||
| $this->server->addPlugin(new DAV\Sharing\Plugin($authBackend, \OC::$server->getRequest(), \OC::$server->getConfig())); |
Check notice
Code scanning / Psalm
DeprecatedMethod
| \OC::$server->getCommentsManager(), | ||
| $userSession | ||
| )); | ||
| if (\OC::$server->getConfig()->getAppValue('dav', 'sendInvitations', 'yes') === 'yes') { |
Check notice
Code scanning / Psalm
DeprecatedMethod
| \OC::$server->getCommentsManager(), | ||
| $userSession | ||
| )); | ||
| if (\OC::$server->getConfig()->getAppValue('dav', 'sendInvitations', 'yes') === 'yes') { |
Check notice
Code scanning / Psalm
DeprecatedMethod
Signed-off-by: SebastianKrupinski <[email protected]>
| $senderName = $senderName->getValue() ?? null; | ||
| // Due to a bug in sabre, the senderName property for an iTIP message can actually also be a VObject Property | ||
| // If the iTIP message senderName is null or empty use the user session name as the senderName | ||
| if (($iTipMessage->senderName instanceof Parameter) && !empty(trim($iTipMessage->senderName->getValue()))) { |
Check notice
Code scanning / Psalm
PossiblyNullArgument
| $senderName = $iTipMessage->senderName; | ||
| } | ||
| else { | ||
| $senderName = $this->userSession->getUser()->getDisplayName(); |
There was a problem hiding this comment.
Might be an opportunity to trim $senderName afterwards for all cases.
| $senderName = $iTipMessage->senderName; | ||
| } | ||
| else { | ||
| $senderName = $this->userSession->getUser()->getDisplayName(); |
There was a problem hiding this comment.
Even though this should be safe when registered through dav server, it might not be when used through apps/dav/appinfo/v1/caldav.php (very legacy stuff, but still). I'd add a check to see if getUser() isn't null (and psalm would be happy).
|
@tcitworld thank you for the input. I will apply your recommendations. |
Signed-off-by: SebastianKrupinski <[email protected]>
|
|
…serManager Signed-off-by: SebastianKrupinski <[email protected]>
Signed-off-by: SebastianKrupinski <[email protected]>
| // Due to a bug in sabre, the senderName property for an iTIP message can actually also be a VObject Property | ||
| // If the iTIP message senderName is null or empty use the user session name as the senderName | ||
| if (($iTipMessage->senderName instanceof Parameter) && !empty(trim($iTipMessage->senderName->getValue()))) { | ||
| $senderName = trim($iTipMessage->senderName->getValue()); |
Check notice
Code scanning / Psalm
PossiblyNullArgument
| } elseif (is_string($iTipMessage->senderName) && !empty(trim($iTipMessage->senderName))) { | ||
| $senderName = trim($iTipMessage->senderName); | ||
| } elseif ($this->userSession->getUser() !== null) { | ||
| $senderName = trim($this->userSession->getUser()->getDisplayName()); |
Check notice
Code scanning / Psalm
PossiblyNullReference
|
Thanks for your first pull request and welcome to the community! Feel free to keep them coming! If you are looking for issues to tackle then have a look at this selection: https://github.com/nextcloud/server/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22 |
|
@SebastianKrupinski could we backport this to stable29 ? |
I have no issue back porting it... Let me just ask if there is any reason we shoudn't |
|
Go |
|
/backport to stable29 |
|
/backport to stable28 |
Summary
Do not load IMipPlugin before user is authenticated and user session is initilized