Avii/Radicale
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

sharing/config: check for invalid permission combination

Browse Source
This commit is contained in:
Peter Bieringer
2026-04-03 16:07:14 +02:00
parent b6c1612bf1
commit a6ddf4c9e9
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
radicale/sharing/__init__.py
View File

@@ -749,6 +749,10 @@ class BaseSharing:
for permission in request_data[key]:
if permission not in rights.INTERNAL_PERMISSIONS:
return httputils.bad_request("Invalid value for Permissions")
if "p" in request_data[key] and "P" in request_data[key]:
return httputils.bad_request("Invalid combination of Permissions (P+p)")
if "e" in request_data[key] and "E" in request_data[key]:
return httputils.bad_request("Invalid combination of Permissions (E+e)")
elif key == "PathOrToken":
if ShareType == "token":
if not re.search('^/.token/' + TOKEN_PATTERN_V1 + '/$', request_data[key]):