Avii/Radicale
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

sharing/config: check for invalid permission combination

Browse Source
This commit is contained in:
Peter Bieringer
2026-04-03 16:07:14 +02:00
parent b6c1612bf1
commit a6ddf4c9e9
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
radicale/config.py
View File

@@ -69,7 +69,11 @@ def positive_float(value: Any) -> float:
def rights_permission(value: Any) -> str:
for permission in value:
if permission not in rights.INTERNAL_PERMISSIONS:
raise ValueError("unsupported permssion %r found in: %r" % (permission, value))
raise ValueError("unsupported permission %r found in: %r" % (permission, value))
if "p" in value and "P" in value:
raise ValueError("invalid combination of permissions (P+p) found in %r", value)
if "e" in value and "E" in value:
raise ValueError("invalid combination of permissions (E+e) found in %r", value)
return value

4
radicale/sharing/__init__.py
View File

@@ -749,6 +749,10 @@ class BaseSharing:
for permission in request_data[key]:
if permission not in rights.INTERNAL_PERMISSIONS:
return httputils.bad_request("Invalid value for Permissions")
if "p" in request_data[key] and "P" in request_data[key]:
return httputils.bad_request("Invalid combination of Permissions (P+p)")
if "e" in request_data[key] and "E" in request_data[key]:
return httputils.bad_request("Invalid combination of Permissions (E+e)")
elif key == "PathOrToken":
if ShareType == "token":
if not re.search('^/.token/' + TOKEN_PATTERN_V1 + '/$', request_data[key]):