From f65dc9d096f3d53bf50057a44515d20328a9e7ab Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Tue, 9 Jun 2026 21:33:17 +0200 Subject: [PATCH 1/6] sharing: code cosmetics --- radicale/sharing/__init__.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/radicale/sharing/__init__.py b/radicale/sharing/__init__.py index d6363bd4..551450cd 100644 --- a/radicale/sharing/__init__.py +++ b/radicale/sharing/__init__.py @@ -1324,8 +1324,9 @@ class BaseSharing: User=User, Timestamp=Timestamp, Properties=Properties, + Conversion=Conversion, Actions=Actions, - Conversion=Conversion) + ) else: result = self.database_update_sharing( ShareType=ShareType, @@ -1338,8 +1339,9 @@ class BaseSharing: User=User, Timestamp=Timestamp, Properties=Properties, + Conversion=Conversion, Actions=Actions, - Conversion=Conversion) + ) elif user == share['User']: # User is only allowed to update Properties From 26342d2a62659e17bc711bb9d6369450b2e0e5a4 Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Tue, 9 Jun 2026 21:34:15 +0200 Subject: [PATCH 2/6] sharing: adjust result codes for unsupported calls --- radicale/sharing/__init__.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/radicale/sharing/__init__.py b/radicale/sharing/__init__.py index 551450cd..0c010330 100644 --- a/radicale/sharing/__init__.py +++ b/radicale/sharing/__init__.py @@ -947,7 +947,7 @@ class BaseSharing: Conversion = request_data['Conversion'] # verify against whitelist if Conversion not in CONVERSIONS_WHITELIST: - return httputils.bad_request("Conversion not supported: %r" % Conversion) + return httputils.bad_request("Conversion is not supported: %r" % Conversion) if 'Actions' in request_data: valid = True # default @@ -1060,11 +1060,11 @@ class BaseSharing: return httputils.NOT_FOUND if not isinstance(item, storage.BaseCollection): logger.warning(api_info + ": PathMapped=%r is not a collection", PathMapped) - return httputils.METHOD_NOT_ALLOWED + return httputils.bad_request("PathMapped is not a collection") if Conversion == "bday": if item.tag != "VADDRESSBOOK": logger.warning(api_info + ": PathMapped=%r is not a VADDRESSBOOK collection (mandatory for Conversion=%r)", PathMapped, Conversion) - return httputils.METHOD_NOT_ALLOWED + return httputils.bad_request("Conversion is not supported for collection type") if Permissions is None: if ShareType == "token": @@ -1081,7 +1081,7 @@ class BaseSharing: for permission in Permissions: if permission not in "rPp": logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion) - return httputils.METHOD_NOT_ALLOWED + return httputils.bad_request("Permissions are not supported for conversion") if Enabled is None: Enabled = False # security by default @@ -1299,7 +1299,7 @@ class BaseSharing: for permission in Permissions: if permission not in "rPp": logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion) - return httputils.METHOD_NOT_ALLOWED + return httputils.bad_request("Permissions are not supported for conversion") if user == share['Owner']: if PathMapped is not None: From a5a42546b44df781fe9db98c06fcb68f04c29707 Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Tue, 9 Jun 2026 21:34:42 +0200 Subject: [PATCH 3/6] sharing/update: check given Conversion --- radicale/sharing/__init__.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/radicale/sharing/__init__.py b/radicale/sharing/__init__.py index 0c010330..fbbde5b5 100644 --- a/radicale/sharing/__init__.py +++ b/radicale/sharing/__init__.py @@ -1301,6 +1301,11 @@ class BaseSharing: logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion) return httputils.bad_request("Permissions are not supported for conversion") + if Conversion is not None and share['Conversion'] is not None: + if Conversion != share['Conversion']: + logger.warning(api_info + ": PathMapped=%r change of Conversion %r -> %r is not supported", PathMapped, share['Conversion'], Conversion) + return httputils.bad_request("Change of conversion is not supported") + if user == share['Owner']: if PathMapped is not None: # check access Permissions From 169d6c3b45f2f17af795b8d416f8b3e654fe0b04 Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Tue, 9 Jun 2026 21:35:11 +0200 Subject: [PATCH 4/6] sharing/test: align changed result codes --- radicale/tests/test_sharing.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/radicale/tests/test_sharing.py b/radicale/tests/test_sharing.py index 2e3bd408..daf28374 100644 --- a/radicale/tests/test_sharing.py +++ b/radicale/tests/test_sharing.py @@ -4756,7 +4756,7 @@ permissions: RrWw""") json_dict['Enabled'] = True json_dict['Hidden'] = False json_dict['Properties'] = {"D:displayname": "Test-BDAY"} - _, headers, answer = self._sharing_api_json("map", "create", check=405, login="owner:ownerpw", json_dict=json_dict) + _, headers, answer = self._sharing_api_json("map", "create", check=400, login="owner:ownerpw", json_dict=json_dict) # create map logging.info("\n*** create map(bday) user/owner:r -> ok") @@ -6243,7 +6243,7 @@ permissions: RrWw""") json_dict['Permissions'] = "rw" json_dict['Hidden'] = False json_dict['Conversion'] = "bday" - _, headers, answer = self._sharing_api_json("token", "create", check=405, login="owner:ownerpw", json_dict=json_dict) + _, headers, answer = self._sharing_api_json("token", "create", check=400, login="owner:ownerpw", json_dict=json_dict) # check PROPFIND item with token logging.info("\n*** PROPFIND item with token -> calendar") @@ -6378,7 +6378,7 @@ permissions: RrWw""") json_dict['User'] = "owner" json_dict['PathOrToken'] = path_shared json_dict['Permissions'] = "rPe" - _, headers, answer = self._sharing_api_json("token", "update", check=405, login="owner:ownerpw", json_dict=json_dict) + _, headers, answer = self._sharing_api_json("token", "update", check=400, login="owner:ownerpw", json_dict=json_dict) # update map to "rPE" logging.info("\n*** update token with bday conversion ('rPE' permissions) -> not supported") @@ -6386,7 +6386,7 @@ permissions: RrWw""") json_dict['User'] = "owner" json_dict['PathOrToken'] = path_shared json_dict['Permissions'] = "rPE" - _, headers, answer = self._sharing_api_json("token", "update", check=405, login="owner:ownerpw", json_dict=json_dict) + _, headers, answer = self._sharing_api_json("token", "update", check=400, login="owner:ownerpw", json_dict=json_dict) # update map Conversion logging.info("\n*** update token remove Conversion -> not supported") @@ -6432,7 +6432,7 @@ permissions: RrWw""") json_dict['Enabled'] = True json_dict['Hidden'] = False json_dict['Conversion'] = "bday" - _, headers, answer = self._sharing_api_json("token", "create", check=405, login="owner:ownerpw", json_dict=json_dict) + _, headers, answer = self._sharing_api_json("token", "create", check=400, login="owner:ownerpw", json_dict=json_dict) def test_sharing_api_map_properies_overlay_unicode(self) -> None: """share-by-map API usage tests related to properties overlay using unicode.""" From 25e376874e29ed919a8e75932e4bc7619d2fe79c Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Tue, 9 Jun 2026 21:35:27 +0200 Subject: [PATCH 5/6] sharing/update: add test case changing Conversion --- radicale/tests/test_sharing.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/radicale/tests/test_sharing.py b/radicale/tests/test_sharing.py index daf28374..05108d57 100644 --- a/radicale/tests/test_sharing.py +++ b/radicale/tests/test_sharing.py @@ -4774,6 +4774,15 @@ permissions: RrWw""") answer_dict = json.loads(answer) assert answer_dict['Status'] == "success" + # update map with (denied) conversion change + logging.info("\n*** update map(bday), try to change Conversion -> fail") + json_dict = {} + json_dict['User'] = "user" + json_dict['PathMapped'] = path_mapped + json_dict['PathOrToken'] = path_shared_r + json_dict['Conversion'] = "none" + _, headers, answer = self._sharing_api_json("map", "update", check=400, login="owner:ownerpw", json_dict=json_dict) + # enable map by user logging.info("\n*** enable map(bday) by user") json_dict = {} From 64761ae119c43c259c6daa837d5ca17c0e17ff31 Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Tue, 9 Jun 2026 21:49:39 +0200 Subject: [PATCH 6/6] sharing/update: positive test with equal conversion --- radicale/tests/test_sharing.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/radicale/tests/test_sharing.py b/radicale/tests/test_sharing.py index 05108d57..d44f53f5 100644 --- a/radicale/tests/test_sharing.py +++ b/radicale/tests/test_sharing.py @@ -4783,6 +4783,15 @@ permissions: RrWw""") json_dict['Conversion'] = "none" _, headers, answer = self._sharing_api_json("map", "update", check=400, login="owner:ownerpw", json_dict=json_dict) + # update map with same conversion + logging.info("\n*** update map(bday) with equal Conversion -> ok") + json_dict = {} + json_dict['User'] = "user" + json_dict['PathMapped'] = path_mapped + json_dict['PathOrToken'] = path_shared_r + json_dict['Conversion'] = "bday" + _, headers, answer = self._sharing_api_json("map", "update", check=200, login="owner:ownerpw", json_dict=json_dict) + # enable map by user logging.info("\n*** enable map(bday) by user") json_dict = {}