Merge pull request #43722 from nextcloud/backport/43664/stable28

nextcloud · Feb 21, 2024 · dc68447 · dc68447
2 parents 21bc3a3 + 4adda64
commit dc68447
Showing 1 changed file with 9 additions and 4 deletions.
diff --git a/apps/dav/lib/Connector/Sabre/DavAclPlugin.php b/apps/dav/lib/Connector/Sabre/DavAclPlugin.php
@@ -8,6 +8,7 @@
  * @author Robin Appelman <[email protected]>
  * @author Roeland Jago Douma <[email protected]>
  * @author Thomas Müller <[email protected]>
+ * @author Richard Steinmetz <[email protected]>
  *
  * @license AGPL-3.0
  *
@@ -105,11 +106,15 @@ public function beforeMethod(RequestInterface $request, ResponseInterface $respo
 
 		parent::beforeMethod($request, $response);
 
-		$createAddressbookOrCalendarRequest = ($request->getMethod() === 'MKCALENDAR' || $request->getMethod() === 'MKCOL')
-			&& (str_starts_with($path, 'addressbooks/') || str_starts_with($path, 'calendars/'));
+		if (!str_starts_with($path, 'addressbooks/') && !str_starts_with($path, 'calendars/')) {
+			return;
+		}
 
-		if ($createAddressbookOrCalendarRequest) {
-			[$parentName] = \Sabre\Uri\split($path);
+		[$parentName] = \Sabre\Uri\split($path);
+		if ($request->getMethod() === 'REPORT') {
+			// is calendars/users/bob or addressbooks/users/bob readable?
+			$this->checkPrivileges($parentName, '{DAV:}read');
+		} elseif ($request->getMethod() === 'MKCALENDAR' || $request->getMethod() === 'MKCOL') {
 			// is calendars/users/bob or addressbooks/users/bob writeable?
 			$this->checkPrivileges($parentName, '{DAV:}write');
 		}