upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-22 23:03:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 54

perf: skip request without read permission

Browse source 
Signed-off-by: Richard Steinmetz <richard@steinmetz.cloud>
This commit is contained in:
Richard Steinmetz 2024-02-19 09:39:26 +01:00
parent 82af5cc592
commit 8cce736dcb
No known key found for this signature in database
GPG key ID: 27137D9E7D273FB2
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
apps/dav/lib/Connector/Sabre/DavAclPlugin.php
View file

@ -8,6 +8,7 @@
* @author Robin Appelman <robin@icewind.nl>
* @author Roeland Jago Douma <roeland@famdouma.nl>
* @author Thomas Müller <thomas.mueller@tmit.eu>
* @author Richard Steinmetz <richard@steinmetz.cloud>
*
* @license AGPL-3.0
*
@ -109,11 +110,15 @@ class DavAclPlugin extends \Sabre\DAVACL\Plugin {
parent::beforeMethod($request, $response);
$createAddressbookOrCalendarRequest = ($request->getMethod() === 'MKCALENDAR' || $request->getMethod() === 'MKCOL')
&& (str_starts_with($path, 'addressbooks/') || str_starts_with($path, 'calendars/'));
if (!str_starts_with($path, 'addressbooks/') && !str_starts_with($path, 'calendars/')) {
return;
}
if ($createAddressbookOrCalendarRequest) {
[$parentName] = \Sabre\Uri\split($path);
[$parentName] = \Sabre\Uri\split($path);
if ($request->getMethod() === 'REPORT') {
// is calendars/users/bob or addressbooks/users/bob readable?
$this->checkPrivileges($parentName, '{DAV:}read');
} elseif ($request->getMethod() === 'MKCALENDAR' || $request->getMethod() === 'MKCOL') {
// is calendars/users/bob or addressbooks/users/bob writeable?
$this->checkPrivileges($parentName, '{DAV:}write');
}