diff options
| author | Anna Larch <anna@nextcloud.com> | 2023-05-16 13:09:26 +0200 |
|---|---|---|
| committer | Christoph Wurst <christoph@winzerhof-wurst.at> | 2023-05-23 10:58:29 +0200 |
| commit | 3c93ce9c25f26984c589ca04738cd113a434ddd3 (patch) | |
| tree | 315c393c33f847f1d0dbf31438b8798a1ee7aa1c /apps/dav/lib/CardDAV | |
| parent | 4e9e91a21595e0168212ec37dde39d9cb1ba8914 (diff) | |
| download | nextcloud-server-3c93ce9c25f26984c589ca04738cd113a434ddd3.tar.gz nextcloud-server-3c93ce9c25f26984c589ca04738cd113a434ddd3.zip | |
fix(carddav): Check if SERVER variables are set before accessing them
Signed-off-by: Anna Larch <anna@nextcloud.com>
Diffstat (limited to 'apps/dav/lib/CardDAV')
| -rw-r--r-- | apps/dav/lib/CardDAV/SystemAddressbook.php | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/apps/dav/lib/CardDAV/SystemAddressbook.php b/apps/dav/lib/CardDAV/SystemAddressbook.php index 41e473ede63..c936ad2344f 100644 --- a/apps/dav/lib/CardDAV/SystemAddressbook.php +++ b/apps/dav/lib/CardDAV/SystemAddressbook.php @@ -35,14 +35,12 @@ use OCP\IConfig; use OCP\IGroupManager; use OCP\IL10N; use OCP\IRequest; -use OCP\IUser; use OCP\IUserSession; use Sabre\CardDAV\Backend\SyncSupport; use Sabre\CardDAV\Backend\BackendInterface; use Sabre\CardDAV\Card; use Sabre\DAV\Exception\Forbidden; use Sabre\DAV\Exception\NotFound; -use Sabre\DAV\ICollection; use Sabre\VObject\Component\VCard; use Sabre\VObject\Reader; use function array_filter; @@ -234,12 +232,13 @@ class SystemAddressbook extends AddressBook { } /** @psalm-suppress NoInterfaceProperties */ - if ($this->request->server['PHP_AUTH_USER'] !== 'system') { + $server = $this->request->server; + if (!isset($server['PHP_AUTH_USER']) || $server['PHP_AUTH_USER'] !== 'system') { return false; } /** @psalm-suppress NoInterfaceProperties */ - $sharedSecret = $this->request->server['PHP_AUTH_PW']; + $sharedSecret = $server['PHP_AUTH_PW'] ?? null; if ($sharedSecret === null) { return false; } @@ -299,7 +298,7 @@ class SystemAddressbook extends AddressBook { } public function getACL() { - return array_filter(parent::getACL(), function($acl) { + return array_filter(parent::getACL(), function ($acl) { if (in_array($acl['privilege'], ['{DAV:}write', '{DAV:}all'], true)) { return false; } |