Skip to content

Commit 53a9a9c

Browse files
DeepDiver1975LukasReschke
DeepDiver1975
authored and
LukasReschke
committed
Use true random string as uri for public calendars - as a result we can no longer return the pre-publish-url
1 parent 5ed3ab3 commit 53a9a9c

11 files changed

Lines changed: 73 additions & 47 deletions

File tree

‎apps/dav/appinfo/v1/caldav.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,9 @@
4747
);
4848
$db = \OC::$server->getDatabaseConnection();
4949
$config = \OC::$server->getConfig();
50-
$calDavBackend = new CalDavBackend($db, $principalBackend, \OC::$server->getUserManager(), $config);
50+
$userManager = \OC::$server->getUserManager();
51+
$random = \OC::$server->getSecureRandom();
52+
$calDavBackend = new CalDavBackend($db, $principalBackend, $userManager, $config, $random);
5153

5254
$debugging = \OC::$server->getConfig()->getSystemValue('debug', false);
5355

‎apps/dav/lib/AppInfo/Application.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,12 +93,15 @@ public function __construct (array $urlParams=array()) {
9393
$container->registerService('CalDavBackend', function($c) {
9494
/** @var IAppContainer $c */
9595
$db = $c->getServer()->getDatabaseConnection();
96+
$userManager = $c->getServer()->getUserManager();
9697
$config = $c->getServer()->getConfig();
98+
$random = $c->getServer()->getSecureRandom();
99+
97100
$principal = new Principal(
98101
$c->getServer()->getUserManager(),
99102
$c->getServer()->getGroupManager()
100103
);
101-
return new CalDavBackend($db, $principal, $c->getServer()->getUserManager(), $config);
104+
return new CalDavBackend($db, $principal, $userManager, $config, $random);
102105
});
103106

104107
$container->registerService('BirthdayService', function($c) {

‎apps/dav/lib/CalDAV/CalDavBackend.php‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@
3333
use OCP\IDBConnection;
3434
use OCP\IUser;
3535
use OCP\IUserManager;
36+
use OCP\Security\ISecureRandom;
3637
use Sabre\CalDAV\Backend\AbstractBackend;
3738
use Sabre\CalDAV\Backend\SchedulingSupport;
3839
use Sabre\CalDAV\Backend\SubscriptionSupport;
@@ -124,23 +125,29 @@ class CalDavBackend extends AbstractBackend implements SyncSupport, Subscription
124125
/** @var IConfig */
125126
private $config;
126127

128+
/** @var ISecureRandom */
129+
private $random;
130+
127131
/**
128132
* CalDavBackend constructor.
129133
*
130134
* @param IDBConnection $db
131135
* @param Principal $principalBackend
132136
* @param IUserManager $userManager
133137
* @param IConfig $config
138+
* @param ISecureRandom $random
134139
*/
135140
public function __construct(IDBConnection $db,
136141
Principal $principalBackend,
137142
IUserManager $userManager,
138-
IConfig $config) {
143+
IConfig $config,
144+
ISecureRandom $random) {
139145
$this->db = $db;
140146
$this->principalBackend = $principalBackend;
141147
$this->userManager = $userManager;
142148
$this->sharingBackend = new Backend($this->db, $principalBackend, 'calendar');
143149
$this->config = $config;
150+
$this->random = $random;
144151
}
145152

146153
/**
@@ -400,10 +407,9 @@ public function getPublicCalendar($uri) {
400407
if ($row['components']) {
401408
$components = explode(',',$row['components']);
402409
}
403-
$uri = md5($this->config->getSystemValue('secret', '') . $row['id']);
404410
$calendar = [
405411
'id' => $row['id'],
406-
'uri' => $uri,
412+
'uri' => $row['publicuri'],
407413
'principaluri' => $row['principaluri'],
408414
'{' . Plugin::NS_CALENDARSERVER . '}getctag' => 'http://sabre.io/ns/sync/' . ($row['synctoken']?$row['synctoken']:'0'),
409415
'{http://sabredav.org/ns}sync-token' => $row['synctoken']?$row['synctoken']:'0',
@@ -1594,24 +1600,28 @@ public function getShares($resourceId) {
15941600
/**
15951601
* @param boolean $value
15961602
* @param \OCA\DAV\CalDAV\Calendar $calendar
1603+
* @return string|null
15971604
*/
15981605
public function setPublishStatus($value, $calendar) {
15991606
$query = $this->db->getQueryBuilder();
16001607
if ($value) {
1608+
$publicUri = $this->random->generate(16, ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS);
16011609
$query->insert('dav_shares')
16021610
->values([
16031611
'principaluri' => $query->createNamedParameter($calendar->getPrincipalURI()),
16041612
'type' => $query->createNamedParameter('calendar'),
16051613
'access' => $query->createNamedParameter(self::ACCESS_PUBLIC),
16061614
'resourceid' => $query->createNamedParameter($calendar->getResourceId()),
1607-
'publicuri' => $query->createNamedParameter(md5($this->config->getSystemValue('secret', '') . $calendar->getResourceId()))
1615+
'publicuri' => $query->createNamedParameter($publicUri)
16081616
]);
1609-
} else {
1610-
$query->delete('dav_shares')
1611-
->where($query->expr()->eq('resourceid', $query->createNamedParameter($calendar->getResourceId())))
1612-
->andWhere($query->expr()->eq('access', $query->createNamedParameter(self::ACCESS_PUBLIC)));
1617+
$query->execute();
1618+
return $publicUri;
16131619
}
1620+
$query->delete('dav_shares')
1621+
->where($query->expr()->eq('resourceid', $query->createNamedParameter($calendar->getResourceId())))
1622+
->andWhere($query->expr()->eq('access', $query->createNamedParameter(self::ACCESS_PUBLIC)));
16141623
$query->execute();
1624+
return null;
16151625
}
16161626

16171627
/**

‎apps/dav/lib/CalDAV/Calendar.php‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -252,9 +252,12 @@ function calendarQuery(array $filters) {
252252

253253
/**
254254
* @param boolean $value
255+
* @return string|null
255256
*/
256257
function setPublishStatus($value) {
257-
$this->caldavBackend->setPublishStatus($value, $this);
258+
$publicUri = $this->caldavBackend->setPublishStatus($value, $this);
259+
$this->calendarInfo['publicuri'] = $publicUri;
260+
return $publicUri;
258261
}
259262

260263
/**

‎apps/dav/lib/CalDAV/Publishing/PublishPlugin.php‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -94,22 +94,16 @@ public function initialize(Server $server) {
9494

9595
public function propFind(PropFind $propFind, INode $node) {
9696
if ($node instanceof Calendar) {
97-
$token = md5($this->config->getSystemValue('secret', '').$node->getResourceId());
98-
99-
$publishUrl = $this->urlGenerator->getAbsoluteURL($this->server->getBaseUri().'public-calendars/').$token;
100-
101-
$propFind->handle('{'.self::NS_CALENDARSERVER.'}publish-url', function () use ($node, $publishUrl) {
97+
$propFind->handle('{'.self::NS_CALENDARSERVER.'}publish-url', function () use ($node) {
10298
if ($node->getPublishStatus()) {
10399
// We return the publish-url only if the calendar is published.
100+
$token = $node->getName();
101+
$publishUrl = $this->urlGenerator->getAbsoluteURL($this->server->getBaseUri().'public-calendars/').$token;
102+
104103
return new Publisher($publishUrl, true);
105104
}
106105
});
107106

108-
$propFind->handle('{'.self::NS_CALENDARSERVER.'}pre-publish-url', function () use ($node, $publishUrl) {
109-
// The pre-publish-url is always returned
110-
return new Publisher($publishUrl, false);
111-
});
112-
113107
$propFind->handle('{'.self::NS_CALENDARSERVER.'}allowed-sharing-modes', function() use ($node) {
114108
return new AllowedSharingModes(!$node->isSubscription(), !$node->isSubscription());
115109
});

‎apps/dav/lib/Command/CreateCalendar.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,10 @@ protected function execute(InputInterface $input, OutputInterface $output) {
7676
$this->groupManager
7777
);
7878
$config = \OC::$server->getConfig();
79+
$random = \OC::$server->getSecureRandom();
7980

8081
$name = $input->getArgument('name');
81-
$caldav = new CalDavBackend($this->dbConnection, $principalBackend, $this->userManager, $config);
82+
$caldav = new CalDavBackend($this->dbConnection, $principalBackend, $this->userManager, $config, $random);
8283
$caldav->createCalendar("principals/users/$user", $name, []);
8384
}
8485
}

‎apps/dav/lib/DAV/PublicAuth.php‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,6 @@ function challenge(RequestInterface $request, ResponseInterface $response) {
8686
* @return bool
8787
*/
8888
private function isRequestPublic(RequestInterface $request) {
89-
$params = $request->getQueryParameters();
90-
if (isset($params['sabreAction']) && $params['sabreAction'] == 'asset') {
91-
return true;
92-
}
9389
$url = $request->getPath();
9490
$matchingUrls = array_filter($this->publicURLs, function ($publicUrl) use ($url) {
9591
return strpos($url, $publicUrl, 0) === 0;

‎apps/dav/lib/RootCollection.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,12 @@ class RootCollection extends SimpleCollection {
3939

4040
public function __construct() {
4141
$config = \OC::$server->getConfig();
42+
$random = \OC::$server->getSecureRandom();
43+
$userManager = \OC::$server->getUserManager();
4244
$db = \OC::$server->getDatabaseConnection();
4345
$dispatcher = \OC::$server->getEventDispatcher();
4446
$userPrincipalBackend = new Principal(
45-
\OC::$server->getUserManager(),
47+
$userManager,
4648
\OC::$server->getGroupManager()
4749
);
4850
$groupPrincipalBackend = new GroupPrincipalBackend(
@@ -60,7 +62,7 @@ public function __construct() {
6062
$systemPrincipals->disableListing = $disableListing;
6163
$filesCollection = new Files\RootCollection($userPrincipalBackend, 'principals/users');
6264
$filesCollection->disableListing = $disableListing;
63-
$caldavBackend = new CalDavBackend($db, $userPrincipalBackend, \OC::$server->getUserManager(), $config);
65+
$caldavBackend = new CalDavBackend($db, $userPrincipalBackend, $userManager, $config, $random);
6466
$calendarRoot = new CalendarRoot($userPrincipalBackend, $caldavBackend, 'principals/users');
6567
$calendarRoot->disableListing = $disableListing;
6668
$publicCalendarRoot = new PublicCalendarRoot($caldavBackend);

‎apps/dav/tests/unit/CalDAV/AbstractCalDavBackendTest.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
use OCA\DAV\Connector\Sabre\Principal;
3030
use OCP\IL10N;
3131
use OCP\IConfig;
32+
use OCP\Security\ISecureRandom;
3233
use Sabre\CalDAV\Xml\Property\SupportedCalendarComponentSet;
3334
use Sabre\DAV\PropPatch;
3435
use Sabre\DAV\Xml\Property\Href;
@@ -56,6 +57,9 @@ abstract class AbstractCalDavBackendTest extends TestCase {
5657
/** var OCP\IConfig */
5758
protected $config;
5859

60+
/** @var ISecureRandom */
61+
private $random;
62+
5963
const UNIT_TEST_USER = 'principals/users/caldav-unit-test';
6064
const UNIT_TEST_USER1 = 'principals/users/caldav-unit-test1';
6165
const UNIT_TEST_GROUP = 'principals/groups/caldav-unit-test-group';
@@ -80,8 +84,8 @@ public function setUp() {
8084

8185
$db = \OC::$server->getDatabaseConnection();
8286
$this->config = \OC::$server->getConfig();
83-
$this->backend = new CalDavBackend($db, $this->principal, $this->userManager, $this->config);
84-
87+
$this->random = \OC::$server->getSecureRandom();
88+
$this->backend = new CalDavBackend($db, $this->principal, $this->userManager, $this->config, $this->random);
8589
$this->tearDown();
8690
}
8791

‎apps/dav/tests/unit/CalDAV/CalDavBackendTest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -350,7 +350,7 @@ public function testPublications() {
350350
$this->assertEquals(1, count($publicCalendars));
351351
$this->assertEquals(true, $publicCalendars[0]['{http://owncloud.org/ns}public']);
352352

353-
$publicCalendarURI = md5($this->config->getSystemValue('secret', '') . $calendar->getResourceId());
353+
$publicCalendarURI = $publicCalendars[0]['uri'];
354354
$publicCalendar = $this->backend->getPublicCalendar($publicCalendarURI);
355355
$this->assertEquals(true, $publicCalendar['{http://owncloud.org/ns}public']);
356356

0 commit comments

Comments
 (0)