fix: add proper ACLs for trashbin proxys#60211
Open
hamza221 wants to merge 1 commit into
Open
Conversation
hamza221
requested review from
ChristophWurst,
SebastianKrupinski and
tcitworld
as code owners
hamza221
force-pushed
the
fix/trashbin-proxy-acls
branch
from
16206b0 to
69b7f74
Compare
hamza221
added
bug
3. to review
ChristophWurst
approved these changes
May 7, 2026
Member
|
/backport to stable33 |
Member
|
/backport to stable32 |
Contributor
Author
|
/backport to stable33 |
Contributor
Author
|
/backport to stable32 |
Contributor
Author
|
@ChristophWurst didn't see your comments :'( |
GVodyanov
approved these changes
May 7, 2026
Contributor
Author
|
reuse unrelated #60205 |
ChristophWurst
added
4. to release
Signed-off-by: Hamza <hamzamahjoubi221@gmail.com>
hamza221
force-pushed
the
fix/trashbin-proxy-acls
branch
from
69b7f74 to
8350e96
Compare
Contributor
Author
|
rebased for green CI |
kesselb
reviewed
May 12, 2026
| 'protected' => true, | ||
| ], | ||
| [ | ||
| 'privilege' => '{DAV:}read', |
Contributor
There was a problem hiding this comment.
Using read intentionally with proxy-write?
Contributor
|
Looks good 👍 I didn't test with an Apple device, but some http request and would like to double-check the expected outcome. We are adding the permission for the trashbin home, and hence the the delgatee should be able to read the owner's trashbin? Alice: Owner Bob can read alice personal calendar ✅ PROPFIND https://server99.internal/remote.php/dav/calendars/alice/personal/
Authorization: Basic bob bob
Content-Type: application/xml; charset=UTF-8
Cookie: XDEBUG_SESSION=PHPSTORM
<x0:propfind xmlns:x0="DAV:">
<x0:prop>
<x0:current-user-privilege-set/>
<x0:displayname/>
<x0:getcontenttype/>
<x0:getetag/>
<x0:owner/>
<x0:resourcetype/>
</x0:prop>
</x0:propfind>Bob can read alice home ✅ PROPFIND https://server99.internal/remote.php/dav/calendars/alice/
Authorization: Basic bob bob
Content-Type: application/xml; charset=UTF-8
Cookie: XDEBUG_SESSION=PHPSTORM
<x0:propfind xmlns:x0="DAV:">
<x0:prop>
<x0:current-user-privilege-set/>
<x0:displayname/>
<x0:getcontenttype/>
<x0:getetag/>
<x0:owner/>
<x0:resourcetype/>
</x0:prop>
</x0:propfind>Bob can read alice trash bin ❌ PROPFIND https://server99.internal/remote.php/dav/calendars/alice/trashbin/
Authorization: Basic bob bob
Content-Type: application/xml; charset=UTF-8
Cookie: XDEBUG_SESSION=PHPSTORM
<x0:propfind xmlns:x0="DAV:">
<x0:prop>
<x0:current-user-privilege-set/>
<x0:displayname/>
<x0:getcontenttype/>
<x0:getetag/>
<x0:owner/>
<x0:resourcetype/>
</x0:prop>
</x0:propfind><?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
<s:exception>Sabre\DAV\Exception\NotFound</s:exception>
<s:message>Node with name 'objects' could not be found</s:message>
</d:error>If accessing the owner's calendar trash is supposed to work, then we need to add the acls also to deleted calendar objects and collection like below, otherwise we the trashbin object must be filtered out before checking access. Index: apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObject.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObject.php b/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObject.php
--- a/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObject.php (revision 8350e960603763cc4baf57d08a38761acb0d7cd2)
+++ b/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObject.php (date 1778618679377)
@@ -105,7 +105,17 @@
],
[
'privilege' => '{DAV:}unbind', // For moving and deletion
- 'principal' => '{DAV:}owner',
+ 'principal' => $this->getOwner(),
+ 'protected' => true,
+ ],
+ [
+ 'privilege' => '{DAV:}read',
+ 'principal' => $this->getOwner() . '/calendar-proxy-write',
+ 'protected' => true,
+ ],
+ [
+ 'privilege' => '{DAV:}read',
+ 'principal' => $this->getOwner() . '/calendar-proxy-read',
'protected' => true,
],
];
Index: apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObjectsCollection.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
diff --git a/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObjectsCollection.php b/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObjectsCollection.php
--- a/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObjectsCollection.php (revision 8350e960603763cc4baf57d08a38761acb0d7cd2)
+++ b/apps/dav/lib/CalDAV/Trashbin/DeletedCalendarObjectsCollection.php (date 1778618679378)
@@ -137,9 +137,19 @@
],
[
'privilege' => '{DAV:}unbind',
- 'principal' => '{DAV:}owner',
+ 'principal' => $this->getOwner(),
+ 'protected' => true,
+ ],
+ [
+ 'privilege' => '{DAV:}read',
+ 'principal' => $this->getOwner() . '/calendar-proxy-write',
+ 'protected' => true,
+ ],
+ [
+ 'privilege' => '{DAV:}read',
+ 'principal' => $this->getOwner() . '/calendar-proxy-read',
'protected' => true,
- ]
+ ],
];
}
} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add proper ACLs for proxys
How I tested
Checklist
3. to review, feature component)stable32)AI (if applicable)