diff options
| author | Anna Larch <anna@nextcloud.com> | 2023-05-16 13:09:26 +0200 |
|---|---|---|
| committer | backportbot-nextcloud[bot] <backportbot-nextcloud[bot]@users.noreply.github.com> | 2023-05-23 12:41:15 +0000 |
| commit | c1ac314ff11176866adeb61636273623561ed0cb (patch) | |
| tree | e9d9e7007bb5d66cee963adcb39a1d69c3841be8 /apps | |
| parent | 713b9603a4e36a41efa0cd2c0ba88e4fa6ab893f (diff) | |
| download | nextcloud-server-c1ac314ff11176866adeb61636273623561ed0cb.tar.gz nextcloud-server-c1ac314ff11176866adeb61636273623561ed0cb.zip | |
fix(carddav): Check if SERVER variables are set before accessing them
Signed-off-by: Anna Larch <anna@nextcloud.com>
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/dav/lib/CardDAV/SystemAddressbook.php | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/apps/dav/lib/CardDAV/SystemAddressbook.php b/apps/dav/lib/CardDAV/SystemAddressbook.php index 41e473ede63..c936ad2344f 100644 --- a/apps/dav/lib/CardDAV/SystemAddressbook.php +++ b/apps/dav/lib/CardDAV/SystemAddressbook.php @@ -35,14 +35,12 @@ use OCP\IConfig; use OCP\IGroupManager; use OCP\IL10N; use OCP\IRequest; -use OCP\IUser; use OCP\IUserSession; use Sabre\CardDAV\Backend\SyncSupport; use Sabre\CardDAV\Backend\BackendInterface; use Sabre\CardDAV\Card; use Sabre\DAV\Exception\Forbidden; use Sabre\DAV\Exception\NotFound; -use Sabre\DAV\ICollection; use Sabre\VObject\Component\VCard; use Sabre\VObject\Reader; use function array_filter; @@ -234,12 +232,13 @@ class SystemAddressbook extends AddressBook { } /** @psalm-suppress NoInterfaceProperties */ - if ($this->request->server['PHP_AUTH_USER'] !== 'system') { + $server = $this->request->server; + if (!isset($server['PHP_AUTH_USER']) || $server['PHP_AUTH_USER'] !== 'system') { return false; } /** @psalm-suppress NoInterfaceProperties */ - $sharedSecret = $this->request->server['PHP_AUTH_PW']; + $sharedSecret = $server['PHP_AUTH_PW'] ?? null; if ($sharedSecret === null) { return false; } @@ -299,7 +298,7 @@ class SystemAddressbook extends AddressBook { } public function getACL() { - return array_filter(parent::getACL(), function($acl) { + return array_filter(parent::getACL(), function ($acl) { if (in_array($acl['privilege'], ['{DAV:}write', '{DAV:}all'], true)) { return false; } |