extern/egroupware_official
1
0
Fork 0
mirror of https://github.com/EGroupware/egroupware.git synced 2025-01-12 08:58:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

not returning deleted entries for read, as they might have identical UID for caldav_name as a non-deleted entry and would therefore block access to these

Browse Source
This commit is contained in:
Ralf Becker 2011-10-04 14:18:35 +00:00
parent 0de2f3c527
commit 23584253fd
4 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
addressbook/inc/class.addressbook_groupdav.inc.php
View File

@ -534,12 +534,22 @@ class addressbook_groupdav extends groupdav_handler
/** /**
* Read a contact * Read a contact
* *
* We have to make sure to not return or even consider in read deleted contacts, as the might have
* the same UID and/or carddav_name as not deleted contacts and would block access to valid entries
*
* @param string|id $id * @param string|id $id
* @return array/boolean array with entry, false if no read rights, null if $id does not exist * @return array/boolean array with entry, false if no read rights, null if $id does not exist
*/ */
function read($id) function read($id)
{ {
$contact = $this->bo->read(array(self::$path_attr => $id)); static $non_deleted_tids;
if (is_null($non_deleted_tids))
{
$non_deleted_tids = $this->bo->content_types;
unset($non_deleted_tids[addressbook_so::DELETED_TYPE]);
$non_deleted_tids = array_keys($non_deleted_tids);
}
$contact = $this->bo->read(array(self::$path_attr => $id, 'tid' => $non_deleted_tids));
if ($contact && $contact['tid'] == addressbook_so::DELETED_TYPE) if ($contact && $contact['tid'] == addressbook_so::DELETED_TYPE)
{ {

5
calendar/inc/class.calendar_groupdav.inc.php
View File

@ -925,6 +925,9 @@ class calendar_groupdav extends groupdav_handler
/** /**
* Read an entry * Read an entry
* *
* We have to make sure to not return or even consider in read deleted events, as the might have
* the same UID and/or caldav_name as not deleted events and would block access to valid entries
*
* @param string|id $id * @param string|id $id
* @return array|boolean array with entry, false if no read rights, null if $id does not exist * @return array|boolean array with entry, false if no read rights, null if $id does not exist
*/ */
@ -932,7 +935,7 @@ class calendar_groupdav extends groupdav_handler
{ {
if (strpos($column=self::$path_attr,'_') === false) $column = 'cal_'.$column; if (strpos($column=self::$path_attr,'_') === false) $column = 'cal_'.$column;
$event = $this->bo->read(array($column => $id), null, true, 'server'); $event = $this->bo->read(array($column => $id, 'cal_deleted IS NULL'), null, true, 'server');
if ($event) $event = array_shift($event); // read with array as 1. param, returns an array of events! if ($event) $event = array_shift($event); // read with array as 1. param, returns an array of events!
if (!($retval = $this->bo->check_perms(EGW_ACL_FREEBUSY,$event, 0, 'server'))) if (!($retval = $this->bo->check_perms(EGW_ACL_FREEBUSY,$event, 0, 'server')))

2
infolog/inc/class.infolog_bo.inc.php
View File

@ -547,7 +547,7 @@ class infolog_bo
function &read($info_id,$run_link_id2from=true,$date_format='ts') function &read($info_id,$run_link_id2from=true,$date_format='ts')
{ {
//error_log(__METHOD__.'('.array2string($info_id).', '.array2string($run_link_id2from).", '$date_format') ".function_backtrace()); //error_log(__METHOD__.'('.array2string($info_id).', '.array2string($run_link_id2from).", '$date_format') ".function_backtrace());
if (is_scalar($info_id) || isset($info_id[0])) if (is_scalar($info_id) || isset($info_id[count($info_id)-1]))
{ {
if (is_scalar($info_id) && !is_numeric($info_id)) if (is_scalar($info_id) && !is_numeric($info_id))
{ {

5
infolog/inc/class.infolog_groupdav.inc.php
View File

@ -462,12 +462,15 @@ class infolog_groupdav extends groupdav_handler
/** /**
* Read an entry * Read an entry
* *
* We have to make sure to not return or even consider in read deleted infologs, as the might have
* the same UID and/or caldav_name as not deleted ones and would block access to valid entries
*
* @param string|id $id * @param string|id $id
* @return array|boolean array with entry, false if no read rights, null if $id does not exist * @return array|boolean array with entry, false if no read rights, null if $id does not exist
*/ */
function read($id) function read($id)
{ {
return $this->bo->read(array(self::$path_attr => $id),false,'server'); return $this->bo->read(array(self::$path_attr => $id, "info_status!='deleted'"),false,'server');
} }
/** /**