From b88b99d11e2c7ee7e55bbfb5e564e589f83a7980 Mon Sep 17 00:00:00 2001 From: Peter Bieringer Date: Fri, 10 Apr 2026 05:51:38 +0200 Subject: [PATCH] sharing/bday: do not permit permissions eE --- radicale/sharing/__init__.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/radicale/sharing/__init__.py b/radicale/sharing/__init__.py index dc926022..41b8067b 100644 --- a/radicale/sharing/__init__.py +++ b/radicale/sharing/__init__.py @@ -880,9 +880,9 @@ class BaseSharing: else: Permissions = str(Permissions) if Conversion == "bday": - # bday is read-only + # bday is read-only and not supporting "Ee" for permission in Permissions: - if permission not in "rPpEe": + if permission not in "rPp": logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion) return httputils.METHOD_NOT_ALLOWED @@ -1081,6 +1081,15 @@ class BaseSharing: logger.trace("" + api_info + ": clear property %r", prop) del Properties[prop] + if Permissions is not None and share['Conversion'] is not None: + Permissions = str(Permissions) + if share['Conversion'] == "bday": + # bday is read-only and not supporting "Ee" + for permission in Permissions: + if permission not in "rPp": + logger.warning(api_info + ": PathMapped=%r Permissions=%r not supported for Conversion=%r", PathMapped, Permissions, Conversion) + return httputils.METHOD_NOT_ALLOWED + if user == share['Owner']: if PathMapped is not None: # check access Permissions