diff options
| author | Simon L <szaimen@e.mail.de> | 2023-05-23 14:33:49 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-23 14:33:49 +0200 |
| commit | 3894a86e74e675cc71fe0847b6132e21243ebdfe (patch) | |
| tree | bb7e1165c716d573d5b75fdd64e23be560448a0c | |
| parent | 0713c1c4c6c7860fc792f0eab1ff712fce3fe14c (diff) | |
| parent | 3c93ce9c25f26984c589ca04738cd113a434ddd3 (diff) | |
| download | nextcloud-server-3894a86e74e675cc71fe0847b6132e21243ebdfe.tar.gz nextcloud-server-3894a86e74e675cc71fe0847b6132e21243ebdfe.zip | |
Merge pull request #38308 from nextcloud/fix/check-for-php-auth-server-variables
fix(carddav): Check if SERVER variables are set before accessing them
| -rw-r--r-- | apps/dav/lib/CardDAV/SystemAddressbook.php | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/apps/dav/lib/CardDAV/SystemAddressbook.php b/apps/dav/lib/CardDAV/SystemAddressbook.php index 41e473ede63..c936ad2344f 100644 --- a/apps/dav/lib/CardDAV/SystemAddressbook.php +++ b/apps/dav/lib/CardDAV/SystemAddressbook.php @@ -35,14 +35,12 @@ use OCP\IConfig; use OCP\IGroupManager; use OCP\IL10N; use OCP\IRequest; -use OCP\IUser; use OCP\IUserSession; use Sabre\CardDAV\Backend\SyncSupport; use Sabre\CardDAV\Backend\BackendInterface; use Sabre\CardDAV\Card; use Sabre\DAV\Exception\Forbidden; use Sabre\DAV\Exception\NotFound; -use Sabre\DAV\ICollection; use Sabre\VObject\Component\VCard; use Sabre\VObject\Reader; use function array_filter; @@ -234,12 +232,13 @@ class SystemAddressbook extends AddressBook { } /** @psalm-suppress NoInterfaceProperties */ - if ($this->request->server['PHP_AUTH_USER'] !== 'system') { + $server = $this->request->server; + if (!isset($server['PHP_AUTH_USER']) || $server['PHP_AUTH_USER'] !== 'system') { return false; } /** @psalm-suppress NoInterfaceProperties */ - $sharedSecret = $this->request->server['PHP_AUTH_PW']; + $sharedSecret = $server['PHP_AUTH_PW'] ?? null; if ($sharedSecret === null) { return false; } @@ -299,7 +298,7 @@ class SystemAddressbook extends AddressBook { } public function getACL() { - return array_filter(parent::getACL(), function($acl) { + return array_filter(parent::getACL(), function ($acl) { if (in_array($acl['privilege'], ['{DAV:}write', '{DAV:}all'], true)) { return false; } |