Avii/Radicale
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

sharing/create/map: access check now earlier

Browse Source
This commit is contained in:
Peter Bieringer
2026-04-21 21:22:48 +02:00
parent a980a5a353
commit eb3448cf39
1 changed files with 6 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
radicale/sharing/__init__.py
View File

@@ -853,6 +853,12 @@ class BaseSharing(ApplicationBase):
logger.warning(api_info + ": missing PathMapped") logger.warning(api_info + ": missing PathMapped")
return httputils.bad_request("Missing PathMapped") return httputils.bad_request("Missing PathMapped")
# check access Permissions
access = Access(self._rights, user, PathMapped, None)
if not access.check("r"):
logger.warning(api_info + ": access to PathMapped=%r not allowed for owner %r", PathMapped, user)
return httputils.NOT_ALLOWED
if Conversion is None: if Conversion is None:
Conversion = "none" Conversion = "none"
@@ -903,12 +909,6 @@ class BaseSharing(ApplicationBase):
HiddenByUser = Hidden HiddenByUser = Hidden
if ShareType == "token": if ShareType == "token":
# check access Permissions
access = Access(self._rights, user, PathMapped)
if not access.check("r"):
logger.warning(api_info + ": access to PathMapped=%r not allowed for owner %r", PathMapped, user)
return httputils.NOT_ALLOWED
if self.permit_create_token is False: if self.permit_create_token is False:
if "t" not in access.permissions: if "t" not in access.permissions:
logger.warning(api_info + ": access to PathMapped=%r not allowed for owner %r (permit=False but explict grant misses 't')", PathMapped, user) logger.warning(api_info + ": access to PathMapped=%r not allowed for owner %r (permit=False but explict grant misses 't')", PathMapped, user)
@@ -972,12 +972,6 @@ class BaseSharing(ApplicationBase):
logger.warning(api_info + ": share already exists with PathMapped=%r User=%r Conversion=%r", PathMapped, User, Conversion) logger.warning(api_info + ": share already exists with PathMapped=%r User=%r Conversion=%r", PathMapped, User, Conversion)
return httputils.CONFLICT return httputils.CONFLICT
# check access Permissions
access = Access(self._rights, user, PathMapped, None) # PathMapped is mandatory
if not access.check("r") and "i" not in access.permissions:
logger.warning(api_info + ": access to PathMapped=%r not allowed for owner %r", PathMapped, user)
return httputils.NOT_ALLOWED
if self.permit_create_map is False: if self.permit_create_map is False:
if "m" not in access.permissions: if "m" not in access.permissions:
logger.warning(api_info + ": access to PathMapped=%r not allowed for owner %r (permit=False but explicit grant misses 'm')", PathMapped, user) logger.warning(api_info + ": access to PathMapped=%r not allowed for owner %r (permit=False but explicit grant misses 'm')", PathMapped, user)