From 8d216a7fdffe5fc576216499fbb20a457e125718 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B4me=20Chilliet?= Date: Tue, 14 Oct 2025 17:50:53 +0200 Subject: [PATCH] fix(dav): Allow arrays (of scalars) in property values MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/dav/lib/DAV/CustomPropertiesBackend.php | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/apps/dav/lib/DAV/CustomPropertiesBackend.php b/apps/dav/lib/DAV/CustomPropertiesBackend.php index a5a58afac92..649297c7688 100644 --- a/apps/dav/lib/DAV/CustomPropertiesBackend.php +++ b/apps/dav/lib/DAV/CustomPropertiesBackend.php @@ -550,7 +550,16 @@ class CustomPropertiesBackend implements BackendInterface { $valueType = self::PROPERTY_TYPE_HREF; $value = $value->getHref(); } else { - if (!is_object($value)) { + if (is_array($value)) { + // For array only allow scalar values + foreach ($value as $item) { + if (!is_scalar($item)) { + throw new DavException( + "Property \"$name\" has an invalid value of array containing " . gettype($value), + ); + } + } + } elseif (!is_object($value)) { throw new DavException( "Property \"$name\" has an invalid value of type " . gettype($value), ); @@ -581,6 +590,10 @@ class CustomPropertiesBackend implements BackendInterface { case self::PROPERTY_TYPE_HREF: return new Href($value); case self::PROPERTY_TYPE_OBJECT: + if (preg_match('/^a:/', $value)) { + // Array, unserialize only scalar values + return unserialize(str_replace('\x00', chr(0), $value), ['allowed_classes' => false]); + } if (!preg_match('/^O\:\d+\:\"(OCA\\\\DAV\\\\|Sabre\\\\(Cal|Card)?DAV\\\\Xml\\\\Property\\\\)/', $value)) { throw new \LogicException('Found an object class serialized in DB that is not allowed'); }