summaryrefslogtreecommitdiffstats
path: root/apps/dav
diff options
context:
space:
mode:
authorRichard Steinmetz <richard@steinmetz.cloud>2024-02-19 09:39:26 +0100
committerbackportbot[bot] <backportbot[bot]@users.noreply.github.com>2024-02-21 12:46:33 +0000
commit4adda64d4ea2d27b4a626beeb9f6e4ef181aacf3 (patch)
treee29625f5cb8517af7ff8d6b59a916adfed808be7 /apps/dav
parent21bc3a3de70f6aa0ca44e0344327d2f2ce8390dc (diff)
downloadnextcloud-server-4adda64d4ea2d27b4a626beeb9f6e4ef181aacf3.tar.gz
nextcloud-server-4adda64d4ea2d27b4a626beeb9f6e4ef181aacf3.zip
perf: skip request without read permission
Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>
Diffstat (limited to 'apps/dav')
-rw-r--r--apps/dav/lib/Connector/Sabre/DavAclPlugin.php13
1 files changed, 9 insertions, 4 deletions
diff --git a/apps/dav/lib/Connector/Sabre/DavAclPlugin.php b/apps/dav/lib/Connector/Sabre/DavAclPlugin.php
index f574cec00c6..236ca3da7fa 100644
--- a/apps/dav/lib/Connector/Sabre/DavAclPlugin.php
+++ b/apps/dav/lib/Connector/Sabre/DavAclPlugin.php
@@ -8,6 +8,7 @@
* @author Robin Appelman <robin@icewind.nl>
* @author Roeland Jago Douma <roeland@famdouma.nl>
* @author Thomas Müller <thomas.mueller@tmit.eu>
+ * @author Richard Steinmetz <richard@steinmetz.cloud>
*
* @license AGPL-3.0
*
@@ -105,11 +106,15 @@ class DavAclPlugin extends \Sabre\DAVACL\Plugin {
parent::beforeMethod($request, $response);
- $createAddressbookOrCalendarRequest = ($request->getMethod() === 'MKCALENDAR' || $request->getMethod() === 'MKCOL')
- && (str_starts_with($path, 'addressbooks/') || str_starts_with($path, 'calendars/'));
+ if (!str_starts_with($path, 'addressbooks/') && !str_starts_with($path, 'calendars/')) {
+ return;
+ }
- if ($createAddressbookOrCalendarRequest) {
- [$parentName] = \Sabre\Uri\split($path);
+ [$parentName] = \Sabre\Uri\split($path);
+ if ($request->getMethod() === 'REPORT') {
+ // is calendars/users/bob or addressbooks/users/bob readable?
+ $this->checkPrivileges($parentName, '{DAV:}read');
+ } elseif ($request->getMethod() === 'MKCALENDAR' || $request->getMethod() === 'MKCOL') {
// is calendars/users/bob or addressbooks/users/bob writeable?
$this->checkPrivileges($parentName, '{DAV:}write');
}