Avii/Radicale
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

sharing/group: improve permission check

Browse Source
This commit is contained in:
Peter Bieringer
2026-07-19 16:28:44 +02:00
parent 92d1ae9317
commit 593388e957
1 changed files with 14 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
radicale/sharing/__init__.py
View File

@@ -1093,10 +1093,9 @@ class BaseSharing:
Permissions = str(Permissions) Permissions = str(Permissions)
if Conversion == "bday": if Conversion == "bday":
# bday is read-only and not supporting "Ee" # bday is read-only and not supporting "Ee"
for permission in Permissions: if rights.intersect(Permissions, "Eew"):
if permission not in "rPp": logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion)
logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion) return httputils.bad_request("Permissions are not supported for conversion: %r" % Permissions)
return httputils.bad_request("Permissions are not supported for conversion")
if Enabled is None: if Enabled is None:
Enabled = False # security by default Enabled = False # security by default
@@ -1212,17 +1211,10 @@ class BaseSharing:
# enforce user toggles for groups # enforce user toggles for groups
HiddenByUser = False HiddenByUser = False
EnabledByUser = True EnabledByUser = True
if "E" in Permissions: if rights.intersect(Permissions, "EP"):
logger.warning(api_info + ": 'E' in Permissions=%r not allowed for group User=%r", Permissions, User) logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for share-by-group/realm", PathMapped, Permissions)
return httputils.NOT_ALLOWED return httputils.bad_request("Permissions are not supported for conversion: %r" % Permissions)
elif "P" in Permissions: Permissions = rights.add(Permissions, "ep") # enforce permissions for group
logger.warning(api_info + ": 'P' in Permissions=%r not allowed for group User=%r", Permissions, User)
return httputils.NOT_ALLOWED
# enforce permissions for group
if "e" not in Permissions:
Permissions += "e"
if "p" not in Permissions:
Permissions += "p"
logger.trace("" + api_info + ": %r (Permissions=%r PathOrToken=%r Owner=%r User=%r)", PathMapped, Permissions, PathOrToken, user, User) logger.trace("" + api_info + ": %r (Permissions=%r PathOrToken=%r Owner=%r User=%r)", PathMapped, Permissions, PathOrToken, user, User)
@@ -1335,10 +1327,9 @@ class BaseSharing:
Permissions = str(Permissions) Permissions = str(Permissions)
if share['Conversion'] == "bday": if share['Conversion'] == "bday":
# bday is read-only and not supporting "Ee" # bday is read-only and not supporting "Ee"
for permission in Permissions: if rights.intersect(Permissions, "Eew"):
if permission not in "rPp": logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion)
logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion) return httputils.bad_request("Permissions are not supported for conversion: %r" % Permissions)
return httputils.bad_request("Permissions are not supported for conversion")
if Conversion is not None and share['Conversion'] is not None: if Conversion is not None and share['Conversion'] is not None:
if Conversion != share['Conversion']: if Conversion != share['Conversion']:
@@ -1348,10 +1339,10 @@ class BaseSharing:
if (User is not None and (User.startswith(SHARING_SEPARATOR_GROUP) or User.startswith(SHARING_SEPARATOR_REALM))) or (share['User'].startswith(SHARING_SEPARATOR_GROUP) or share['User'].startswith(SHARING_SEPARATOR_REALM)): if (User is not None and (User.startswith(SHARING_SEPARATOR_GROUP) or User.startswith(SHARING_SEPARATOR_REALM))) or (share['User'].startswith(SHARING_SEPARATOR_GROUP) or share['User'].startswith(SHARING_SEPARATOR_REALM)):
# enforce user permissions for groups # enforce user permissions for groups
if Permissions is not None: if Permissions is not None:
if "e" not in Permissions: if rights.intersect(Permissions, "EP"):
Permissions += "e" logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for share-by-group/realm", PathMapped, Permissions)
if "p" not in Permissions: return httputils.bad_request("Permissions are not supported for share-by-group/realm: %r" % Permissions)
Permissions += "p" Permissions = rights.add(Permissions, "ep") # enforce permissions for group
if user == share['Owner']: if user == share['Owner']:
if PathMapped is not None: if PathMapped is not None: