Avii/Radicale
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

sharing/proppatch: fix/adjust permission handling

Browse Source
This commit is contained in:
Peter Bieringer
2026-04-03 16:10:34 +02:00
parent 3d7f821300
commit a1d2ed7cf9
1 changed files with 18 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
radicale/app/proppatch.py
View File

@@ -20,6 +20,7 @@
# along with Radicale. If not, see <http://www.gnu.org/licenses/>.
import errno
import logging
import re
import socket
import xml.etree.ElementTree as ET
@@ -113,23 +114,27 @@ class ApplicationPartProppatch(ApplicationBase):
permissions_filter = share['Permissions']
access = Access(self._rights, user, path, permissions_filter)
if not access.check("w"):
logger.debug("TRACE/PROPPATCH/xml_proppatch: no write-access: %r", path)
logger.debug("TRACE/PROPPATCH/xml_proppatch: no native write-access: %r", path)
if share:
# no write access -> use properties overlay
if self._sharing.permit_properties_overlay:
if permissions_filter is not None and "p" in permissions_filter:
logger.info("PROPPATCH request on shared %r: no write-permissions, overlay permitted, but denied by permission 'p'", path_orig)
return httputils.NOT_ALLOWED
# priority share->rights->global
raw_permissions = self._rights.authorization(user, path)
if logger.isEnabledFor(logging.DEBUG):
logger.debug("TRACE/PROPPATCH/share: raw_permissions=%r share[Permissions]=%r permit_properties_overlay=%s", raw_permissions, share['Permissions'], self._sharing.permit_properties_overlay)
if ("P" in share['Permissions'] or
("P" in raw_permissions and "p" not in share['Permissions']) or
(self._sharing.permit_properties_overlay and "p" not in raw_permissions and "p" not in share['Permissions'])
) and not (
"p" in share['Permissions'] or
("p" in raw_permissions and "P" not in share['Permissions']) or
(self._sharing.permit_properties_overlay and "P" not in raw_permissions and "P" not in share['Permissions'])):
logger.info("PROPPATCH request on shared %r: write-access", path_orig)
if permissions_filter is not None and "e" in permissions_filter:
logger.info("PROPPATCH request on shared %r: write-access, overlay enforced, but disabled by permission 'e'", path_orig)
else:
logger.info("PROPPATCH request on shared %r: no write-permissions, overlay permitted by option", path_orig)
share_overlay = True
else:
if permissions_filter is not None and "P" in permissions_filter:
logger.info("PROPPATCH request on shared %r: no write-permissions, overlay denied, but granted by permission 'P'", path_orig)
share_overlay = True
else:
logger.info("PROPPATCH request on shared %r: no write-permissions and overlay denied by option", path_orig)
return httputils.NOT_ALLOWED
logger.info("PROPPATCH request on shared %r: no write-access", path_orig)
return httputils.NOT_ALLOWED
else:
return httputils.NOT_ALLOWED
else: