From 3b4ab6560b1195a8ebd1d0627e142e440b644f1a Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 5 Oct 2017 12:32:46 +0200 Subject: Check if the user/group exists for dav shares Signed-off-by: Joas Schilling --- apps/dav/lib/CalDAV/CalDavBackend.php | 5 ++++- apps/dav/lib/CardDAV/CardDavBackend.php | 5 ++++- apps/dav/lib/Command/CreateCalendar.php | 2 +- apps/dav/lib/DAV/Sharing/Backend.php | 24 +++++++++++++++++++++++- apps/dav/lib/RootCollection.php | 19 +++++++++---------- 5 files changed, 41 insertions(+), 14 deletions(-) (limited to 'apps/dav/lib') diff --git a/apps/dav/lib/CalDAV/CalDavBackend.php b/apps/dav/lib/CalDAV/CalDavBackend.php index 83ef06f29e1..2c34f6d6d31 100644 --- a/apps/dav/lib/CalDAV/CalDavBackend.php +++ b/apps/dav/lib/CalDAV/CalDavBackend.php @@ -32,6 +32,7 @@ use OCP\DB\QueryBuilder\IQueryBuilder; use OCA\DAV\Connector\Sabre\Principal; use OCA\DAV\DAV\Sharing\Backend; use OCP\IDBConnection; +use OCP\IGroupManager; use OCP\IUser; use OCP\IUserManager; use OCP\Security\ISecureRandom; @@ -158,6 +159,7 @@ class CalDavBackend extends AbstractBackend implements SyncSupport, Subscription * @param IDBConnection $db * @param Principal $principalBackend * @param IUserManager $userManager + * @param IGroupManager $groupManager * @param ISecureRandom $random * @param EventDispatcherInterface $dispatcher * @param bool $legacyEndpoint @@ -165,13 +167,14 @@ class CalDavBackend extends AbstractBackend implements SyncSupport, Subscription public function __construct(IDBConnection $db, Principal $principalBackend, IUserManager $userManager, + IGroupManager $groupManager, ISecureRandom $random, EventDispatcherInterface $dispatcher, $legacyEndpoint = false) { $this->db = $db; $this->principalBackend = $principalBackend; $this->userManager = $userManager; - $this->sharingBackend = new Backend($this->db, $principalBackend, 'calendar'); + $this->sharingBackend = new Backend($this->db, $this->userManager, $groupManager, $principalBackend, 'calendar'); $this->random = $random; $this->dispatcher = $dispatcher; $this->legacyEndpoint = $legacyEndpoint; diff --git a/apps/dav/lib/CardDAV/CardDavBackend.php b/apps/dav/lib/CardDAV/CardDavBackend.php index 2e4acad6dfe..7c73a2cb941 100644 --- a/apps/dav/lib/CardDAV/CardDavBackend.php +++ b/apps/dav/lib/CardDAV/CardDavBackend.php @@ -33,6 +33,7 @@ use OCP\DB\QueryBuilder\IQueryBuilder; use OCA\DAV\DAV\Sharing\Backend; use OCA\DAV\DAV\Sharing\IShareable; use OCP\IDBConnection; +use OCP\IGroupManager; use OCP\IUser; use OCP\IUserManager; use PDO; @@ -88,17 +89,19 @@ class CardDavBackend implements BackendInterface, SyncSupport { * @param IDBConnection $db * @param Principal $principalBackend * @param IUserManager $userManager + * @param IGroupManager $groupManager * @param EventDispatcherInterface $dispatcher */ public function __construct(IDBConnection $db, Principal $principalBackend, IUserManager $userManager, + IGroupManager $groupManager, EventDispatcherInterface $dispatcher) { $this->db = $db; $this->principalBackend = $principalBackend; $this->userManager = $userManager; $this->dispatcher = $dispatcher; - $this->sharingBackend = new Backend($this->db, $principalBackend, 'addressbook'); + $this->sharingBackend = new Backend($this->db, $this->userManager, $groupManager, $principalBackend, 'addressbook'); } /** diff --git a/apps/dav/lib/Command/CreateCalendar.php b/apps/dav/lib/Command/CreateCalendar.php index 24990352fab..adc86faa190 100644 --- a/apps/dav/lib/Command/CreateCalendar.php +++ b/apps/dav/lib/Command/CreateCalendar.php @@ -79,7 +79,7 @@ class CreateCalendar extends Command { $dispatcher = \OC::$server->getEventDispatcher(); $name = $input->getArgument('name'); - $caldav = new CalDavBackend($this->dbConnection, $principalBackend, $this->userManager, $random, $dispatcher); + $caldav = new CalDavBackend($this->dbConnection, $principalBackend, $this->userManager, $this->groupManager, $random, $dispatcher); $caldav->createCalendar("principals/users/$user", $name, []); } } diff --git a/apps/dav/lib/DAV/Sharing/Backend.php b/apps/dav/lib/DAV/Sharing/Backend.php index 6cc5e3b6f50..aa4b137f2b0 100644 --- a/apps/dav/lib/DAV/Sharing/Backend.php +++ b/apps/dav/lib/DAV/Sharing/Backend.php @@ -26,11 +26,17 @@ namespace OCA\DAV\DAV\Sharing; use OCA\DAV\Connector\Sabre\Principal; use OCP\IDBConnection; +use OCP\IGroupManager; +use OCP\IUserManager; class Backend { /** @var IDBConnection */ private $db; + /** @var IUserManager */ + private $userManager; + /** @var IGroupManager */ + private $groupManager; /** @var Principal */ private $principalBackend; /** @var string */ @@ -42,11 +48,15 @@ class Backend { /** * @param IDBConnection $db + * @param IUserManager $userManager + * @param IGroupManager $groupManager * @param Principal $principalBackend * @param string $resourceType */ - public function __construct(IDBConnection $db, Principal $principalBackend, $resourceType) { + public function __construct(IDBConnection $db, IUserManager $userManager, IGroupManager $groupManager, Principal $principalBackend, $resourceType) { $this->db = $db; + $this->userManager = $userManager; + $this->groupManager = $groupManager; $this->principalBackend = $principalBackend; $this->resourceType = $resourceType; } @@ -81,6 +91,18 @@ class Backend { return; } + $principal = explode('/', $parts[1], 3); + if (count($principal) !== 3 || $principal[0] !== 'principals' || !in_array($principal[1], ['users', 'groups'], true)) { + // Invalid principal + return; + } + + if (($principal[1] === 'users' && !$this->userManager->userExists($principal[2])) || + ($principal[1] === 'groups' && !$this->groupManager->groupExists($principal[2]))) { + // User or group does not exist + return; + } + // remove the share if it already exists $this->unshare($shareable, $element['href']); $access = self::ACCESS_READ; diff --git a/apps/dav/lib/RootCollection.php b/apps/dav/lib/RootCollection.php index a243ec6d00a..e4ba1f2c02a 100644 --- a/apps/dav/lib/RootCollection.php +++ b/apps/dav/lib/RootCollection.php @@ -41,15 +41,14 @@ class RootCollection extends SimpleCollection { $config = \OC::$server->getConfig(); $random = \OC::$server->getSecureRandom(); $userManager = \OC::$server->getUserManager(); + $groupManager = \OC::$server->getGroupManager(); $db = \OC::$server->getDatabaseConnection(); $dispatcher = \OC::$server->getEventDispatcher(); $userPrincipalBackend = new Principal( $userManager, - \OC::$server->getGroupManager() - ); - $groupPrincipalBackend = new GroupPrincipalBackend( - \OC::$server->getGroupManager() + $groupManager ); + $groupPrincipalBackend = new GroupPrincipalBackend($groupManager); // as soon as debug mode is enabled we allow listing of principals $disableListing = !$config->getSystemValue('debug', false); @@ -62,7 +61,7 @@ class RootCollection extends SimpleCollection { $systemPrincipals->disableListing = $disableListing; $filesCollection = new Files\RootCollection($userPrincipalBackend, 'principals/users'); $filesCollection->disableListing = $disableListing; - $caldavBackend = new CalDavBackend($db, $userPrincipalBackend, $userManager, $random, $dispatcher); + $caldavBackend = new CalDavBackend($db, $userPrincipalBackend, $userManager, $groupManager, $random, $dispatcher); $calendarRoot = new CalendarRoot($userPrincipalBackend, $caldavBackend, 'principals/users'); $calendarRoot->disableListing = $disableListing; $publicCalendarRoot = new PublicCalendarRoot($caldavBackend); @@ -71,28 +70,28 @@ class RootCollection extends SimpleCollection { $systemTagCollection = new SystemTag\SystemTagsByIdCollection( \OC::$server->getSystemTagManager(), \OC::$server->getUserSession(), - \OC::$server->getGroupManager() + $groupManager ); $systemTagRelationsCollection = new SystemTag\SystemTagsRelationsCollection( \OC::$server->getSystemTagManager(), \OC::$server->getSystemTagObjectMapper(), \OC::$server->getUserSession(), - \OC::$server->getGroupManager(), + $groupManager, \OC::$server->getEventDispatcher() ); $commentsCollection = new Comments\RootCollection( \OC::$server->getCommentsManager(), - \OC::$server->getUserManager(), + $userManager, \OC::$server->getUserSession(), \OC::$server->getEventDispatcher(), \OC::$server->getLogger() ); - $usersCardDavBackend = new CardDavBackend($db, $userPrincipalBackend, \OC::$server->getUserManager(), $dispatcher); + $usersCardDavBackend = new CardDavBackend($db, $userPrincipalBackend, $userManager, $groupManager, $dispatcher); $usersAddressBookRoot = new AddressBookRoot($userPrincipalBackend, $usersCardDavBackend, 'principals/users'); $usersAddressBookRoot->disableListing = $disableListing; - $systemCardDavBackend = new CardDavBackend($db, $userPrincipalBackend, \OC::$server->getUserManager(), $dispatcher); + $systemCardDavBackend = new CardDavBackend($db, $userPrincipalBackend, $userManager, $groupManager, $dispatcher); $systemAddressBookRoot = new AddressBookRoot(new SystemPrincipalBackend(), $systemCardDavBackend, 'principals/system'); $systemAddressBookRoot->disableListing = $disableListing; -- cgit v1.2.3