From b09dcc1ead0b14ad746ed6f229e628564dcfb3cb Mon Sep 17 00:00:00 2001
From: Peter Bieringer <pb@bieringer.de>
Date: Sun, 8 Mar 2026 12:33:44 +0100
Subject: [PATCH] sharing: database verification related to Permissions

---
 radicale/sharing/__init__.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/radicale/sharing/__init__.py b/radicale/sharing/__init__.py
index 38867755..d4883133 100644
--- a/radicale/sharing/__init__.py
+++ b/radicale/sharing/__init__.py
@@ -300,6 +300,13 @@ class BaseSharing:
                 else:
                     pass
 
+                # permissions
+                try:
+                    permissions = config.rights_permission(entry['Permissions'])
+                except ValueError as e:
+                    logger.error("Permissions contain invalid entry: %r", entry['Permissions'])
+                    return False
+
                 # check PathMapped exists
                 with self._storage.acquire_lock("r", path=entry['PathMapped']):
                     item = next(iter(self._storage.discover(entry['PathMapped'])), None)