From a6ddf4c9e9c00aac8483a5a86786e3ece75d67e0 Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Fri, 3 Apr 2026 16:07:14 +0200 Subject: [PATCH] sharing/config: check for invalid permission combination --- radicale/config.py | 6 +++++- radicale/sharing/__init__.py | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/radicale/config.py b/radicale/config.py index 9df81561..594bee29 100644 --- a/radicale/config.py +++ b/radicale/config.py @@ -69,7 +69,11 @@ def positive_float(value: Any) -> float: def rights_permission(value: Any) -> str: for permission in value: if permission not in rights.INTERNAL_PERMISSIONS: - raise ValueError("unsupported permssion %r found in: %r" % (permission, value)) + raise ValueError("unsupported permission %r found in: %r" % (permission, value)) + if "p" in value and "P" in value: + raise ValueError("invalid combination of permissions (P+p) found in %r", value) + if "e" in value and "E" in value: + raise ValueError("invalid combination of permissions (E+e) found in %r", value) return value diff --git a/radicale/sharing/__init__.py b/radicale/sharing/__init__.py index 791b19f5..812f0144 100644 --- a/radicale/sharing/__init__.py +++ b/radicale/sharing/__init__.py @@ -749,6 +749,10 @@ class BaseSharing: for permission in request_data[key]: if permission not in rights.INTERNAL_PERMISSIONS: return httputils.bad_request("Invalid value for Permissions") + if "p" in request_data[key] and "P" in request_data[key]: + return httputils.bad_request("Invalid combination of Permissions (P+p)") + if "e" in request_data[key] and "E" in request_data[key]: + return httputils.bad_request("Invalid combination of Permissions (E+e)") elif key == "PathOrToken": if ShareType == "token": if not re.search('^/.token/' + TOKEN_PATTERN_V1 + '/$', request_data[key]):