DAViCal
caldav-PROPPATCH.php
1 <?php
11 dbg_error_log("PROPPATCH", "method handler");
12 
13 require_once('vCalendar.php');
14 require_once('DAVResource.php');
15 
16 $dav_resource = new DAVResource($request->path);
17 if ( !$dav_resource->HavePrivilegeTo('DAV::write-properties') ) {
18  $parent = $dav_resource->GetParentContainer();
19  if ( !$dav_resource->IsBinding() || !$parent->HavePrivilegeTo('DAV::write') ) {
20  $request->PreconditionFailed(403, 'DAV::write-properties', 'You do not have permission to write properties to that resource' );
21  }
22 }
23 
24 $xmltree = BuildXMLTree( $request->xml_tags );
25 
26 // echo $xmltree->Render();
27 
28 if ( $xmltree->GetNSTag() != "DAV::propertyupdate" ) {
29  $request->PreconditionFailed( 403, 'DAV::propertyupdate', 'XML request did not contain a &lt;propertyupdate&gt; tag' );
30 }
31 
35 $setprops = $xmltree->GetPath("/DAV::propertyupdate/DAV::set/DAV::prop/*");
36 $rmprops = $xmltree->GetPath("/DAV::propertyupdate/DAV::remove/DAV::prop/*");
37 
44 $failure = array();
45 $success = array();
46 
47 $reply = new XMLDocument( array( 'DAV:' => '') );
48 
56 function add_failure( $type, $tag, $status, $description=null, $error_tag = null) {
57  global $failure, $reply;
58  $prop = new XMLElement('prop');
59  $reply->NSElement($prop, $tag);
60  $propstat = array($prop,new XMLElement( 'status', $status ));
61 
62  if ( isset($description))
63  $propstat[] = new XMLElement( 'responsedescription', $description );
64  if ( isset($error_tag) )
65  $propstat[] = new XMLElement( 'error', new XMLElement( $error_tag ) );
66 
67  $failure[$type.'-'.$tag] = new XMLElement('propstat', $propstat );
68 }
69 
70 
76 $qry = new AwlQuery();
77 $qry->Begin();
78 $setcalendar = count($xmltree->GetPath('/DAV::propertyupdate/DAV::set/DAV::prop/DAV::resourcetype/urn:ietf:params:xml:ns:caldav:calendar'));
79 foreach( $setprops AS $k => $setting ) {
80  $tag = $setting->GetNSTag();
81  $content = $setting->RenderContent(0,null,true);
82 
83  switch( $tag ) {
84 
85  case 'DAV::displayname':
89  if ( $dav_resource->IsCollection() || $dav_resource->IsPrincipal() ) {
90  if ( $dav_resource->IsBinding() ) {
91  $qry->QDo('UPDATE dav_binding SET dav_displayname = :displayname WHERE dav_name = :dav_name',
92  array( ':displayname' => $content, ':dav_name' => $dav_resource->dav_name()) );
93  }
94  else if ( $dav_resource->IsPrincipal() ) {
95  $qry->QDo('UPDATE dav_principal SET fullname = :displayname, displayname = :displayname, modified = current_timestamp WHERE user_no = :user_no',
96  array( ':displayname' => $content, ':user_no' => $request->user_no) );
97  }
98  else {
99  $qry->QDo('UPDATE collection SET dav_displayname = :displayname, modified = current_timestamp WHERE dav_name = :dav_name',
100  array( ':displayname' => $content, ':dav_name' => $dav_resource->dav_name()) );
101  }
102  $success[$tag] = 1;
103  }
104  else {
105  add_failure('set', $tag, 'HTTP/1.1 403 Forbidden',
106  translate("The displayname may only be set on collections, principals or bindings."), 'cannot-modify-protected-property');
107  }
108  break;
109 
110  case 'DAV::resourcetype':
115  $resourcetypes = $setting->GetPath('DAV::resourcetype/*');
116  $setcollection = false;
117  $setcalendar = false;
118  $setaddressbook = false;
119  $setother = false;
120  foreach( $resourcetypes AS $xnode ) {
121  switch( $xnode->GetNSTag() ) {
122  case 'urn:ietf:params:xml:ns:caldav:calendar': $setcalendar = true; break;
123  case 'urn:ietf:params:xml:ns:carddav:addressbook': $setaddressbook = true; break;
124  case 'DAV::collection': $setcollection = true; break;
125  default:
126  $setother = true;
127  }
128  }
129  if ( $dav_resource->IsCollection() && $setcollection && ! $dav_resource->IsPrincipal() && ! $dav_resource->IsBinding()
130  && !($setcalendar && $setaddressbook) && !$setother ) {
131  $resourcetypes = '<collection xmlns="DAV:"/>';
132  if ( $setcalendar ) $resourcetypes .= '<calendar xmlns="urn:ietf:params:xml:ns:caldav"/>';
133  else if ( $setaddressbook ) $resourcetypes .= '<addressbook xmlns="urn:ietf:params:xml:ns:carddav"/>';
134  $qry->QDo('UPDATE collection SET is_calendar = :is_calendar::boolean, is_addressbook = :is_addressbook::boolean,
135  resourcetypes = :resourcetypes WHERE dav_name = :dav_name',
136  array( ':dav_name' => $dav_resource->dav_name(), ':resourcetypes' => $resourcetypes,
137  ':is_calendar' => $setcalendar, ':is_addressbook' => $setaddressbook ) );
138  $success[$tag] = 1;
139  }
140  else if ( $setcalendar && $setaddressbook ) {
141  add_failure('set', $tag, 'HTTP/1.1 409 Conflict',
142  translate("A collection may not be both a calendar and an addressbook."));
143  }
144  else if ( $setother ) {
145  add_failure('set', $tag, 'HTTP/1.1 403 Forbidden',
146  translate("Unsupported resourcetype modification."), 'cannot-modify-protected-property');
147  }
148  else {
149  add_failure('set', $tag, 'HTTP/1.1 403 Forbidden',
150  translate("Resources may not be changed to / from collections."), 'cannot-modify-protected-property');
151  }
152  break;
153 
154  case 'DAV::group-member-set':
155  if ( $dav_resource->IsProxyCollection() ) {
156  $privileges_read = privilege_to_bits( array('read', 'read-free-busy', 'schedule-deliver') );
157  $privileges_write = privilege_to_bits( array('write', 'schedule-send') );
158  $type = 'read';
159  if ( $dav_resource->IsProxyCollection('write') ) {
160  $type = 'write';
161  }
162 
163  $by_principal = $dav_resource->getProperty('principal_id');
164  $sqlparams = array( ':by_principal' => $by_principal );
165 
166  $existing_grants = array();
167  $qry->QDo('SELECT to_principal, privileges FROM grants WHERE by_principal = :by_principal', $sqlparams);
168  while ( $row = $qry->Fetch() ) {
169  $existing_grants[$row->to_principal] = bindec($row->privileges);
170  }
171 
172  $group_members = $setting->GetElements('DAV::href');
173  foreach( $group_members AS $member ) {
174  $to_principal = new Principal('path', DeconstructURL( $member->GetContent() ));
175  if ( !$to_principal->Exists() ) {
176  add_failure('set', $tag, 'HTTP/1.1 403 Forbidden',
177  translate('Principal not found') . ': ' . $member->GetContent(), 'recognized-principal');
178  break;
179  }
180  $sqlparams[':to_principal'] = $to_principal->principal_id();
181 
182  if ( array_key_exists($to_principal->principal_id(), $existing_grants) ) {
183  $sql = 'UPDATE grants SET privileges=:privileges::INT::BIT(24) WHERE to_principal=:to_principal AND by_principal=:by_principal';
184  $existing_privileges = $existing_grants[$to_principal->principal_id()];
185  unset( $existing_grants[$to_principal->principal_id()] );
186  } else {
187  $sql = 'INSERT INTO grants (by_principal, to_principal, privileges) VALUES(:by_principal, :to_principal, :privileges::INT::BIT(24))';
188  $existing_privileges = 0;
189  }
190 
191  $privileges = $existing_privileges | $privileges_read; // always add read privileges here
192  if ( $type == 'write' ) {
193  $privileges |= $privileges_write; // add write privileges as well
194  } else {
195  $privileges &= $privileges_write ^ DAVICAL_MAXPRIV; // substract write privileges
196  }
197  if ( $privileges == $existing_privileges ) continue; // unchanged
198  $sqlparams[':privileges'] = $privileges;
199 
200  $qry->QDo($sql, $sqlparams);
201  dbg_error_log("PROPPATCH", "group-member-set: %s (%s) is granted %s access to %s", $to_principal->username(), $to_principal->principal_id(), $type, $dav_resource->getProperty('username'));
202 
203  Principal::cacheDelete('dav_name',$to_principal->dav_name());
204  Principal::cacheFlush('principal_id IN (SELECT member_id FROM group_member WHERE group_id = ?)', array($to_principal->principal_id()));
205  }
206 
207  // if there are any remaining grants of our $type, we need to delete them
208  // ("set" means "replace any existing property", WEBDAV RFC2518 12.13.2)
209  foreach ( $existing_grants AS $id => $existing_privs ) {
210  $have_write = $existing_privs & $privileges_write;
211  if ( $type == 'read' && $have_write ) continue;
212  if ( $type == 'write' && ! $have_write ) continue;
213 
214  $negative_readwrite = ( $privileges_read | $privileges_write ) ^ DAVICAL_MAXPRIV;
215  $remaining_privs = $existing_privs & $negative_readwrite;
216 
217  if ( $remaining_privs > 0 ) {
218  $sql = 'UPDATE grants SET privileges=:privileges::INT::BIT(24)';
219  $sqlparams[':privileges'] = $remaining_privs;
220  } else {
221  $sql = 'DELETE FROM grants';
222  }
223  $sqlparams[':to_principal'] = $id;
224  $qry->QDo($sql.' WHERE to_principal=:to_principal AND by_principal=:by_principal', $sqlparams);
225  dbg_error_log("PROPPATCH", "group-member-set: %s is no longer granted %s access to %s", $id, $type, $dav_resource->getProperty('username'));
226  Principal::cacheFlush('principal_id = :to_principal', $sqlparams);
227  }
228  }
229  else {
230  /* @todo PROPPATCH set group-member-set for regular group principal */
231  dbg_error_log("ERROR", "PROPPATCH: set group-member-set for non-proxy collection: don't know what to do!");
232  add_failure('set', $tag, 'HTTP/1.1 403 Forbidden',
233  'group-member-set ' . translate('unimplemented'), 'cannot-modify-protected-property');
234  break;
235  }
236  $success[$tag] = 1;
237  break;
238 
239  case 'urn:ietf:params:xml:ns:caldav:schedule-calendar-transp':
240  if ( $dav_resource->IsCollection() && ( $dav_resource->IsCalendar() || $setcalendar ) && !$dav_resource->IsBinding() ) {
241  $transparency = $setting->GetPath('urn:ietf:params:xml:ns:caldav:schedule-calendar-transp/*');
242  $transparency = preg_replace( '{^.*:}', '', $transparency[0]->GetNSTag());
243  $qry->QDo('UPDATE collection SET schedule_transp = :transparency WHERE dav_name = :dav_name',
244  array( ':dav_name' => $dav_resource->dav_name(), ':transparency' => $transparency ) );
245  $success[$tag] = 1;
246  }
247  else {
248  add_failure('set', $tag, 'HTTP/1.1 409 Conflict',
249  translate("The CalDAV:schedule-calendar-transp property may only be set on calendars."));
250  }
251  break;
252 
253  case 'urn:ietf:params:xml:ns:caldav:calendar-free-busy-set':
254  add_failure('set', $tag, 'HTTP/1.1 409 Conflict',
255  translate("The calendar-free-busy-set is superseded by the schedule-calendar-transp property of a calendar collection.") );
256  break;
257 
258  case 'urn:ietf:params:xml:ns:caldav:calendar-timezone':
259  if ( $dav_resource->IsCollection() && $dav_resource->IsCalendar() && ! $dav_resource->IsBinding() ) {
260  $tzcomponent = $setting->GetPath('urn:ietf:params:xml:ns:caldav:calendar-timezone');
261  $tzstring = $tzcomponent[0]->GetContent();
262  $calendar = new vCalendar( $tzstring );
263  $timezones = $calendar->GetComponents('VTIMEZONE');
264  if ( count($timezones) == 0 ) break;
265  $tz = $timezones[0]; // Backward compatibility
266  $tzid = $tz->GetPValue('TZID');
267  $params = array( ':tzid' => $tzid );
268  $qry = new AwlQuery('SELECT 1 FROM timezones WHERE tzid = :tzid', $params );
269  if ( $qry->Exec('PUT',__LINE__,__FILE__) && $qry->rows() == 0 ) {
270  $params[':olson_name'] = $calendar->GetOlsonName($tz);
271  $params[':vtimezone'] = (isset($tz) ? $tz->Render() : null );
272  $qry->QDo('INSERT INTO timezones (tzid, olson_name, active, vtimezone) VALUES(:tzid,:olson_name,false,:vtimezone)', $params );
273  }
274 
275  $qry->QDo('UPDATE collection SET timezone = :tzid WHERE dav_name = :dav_name',
276  array( ':tzid' => $tzid, ':dav_name' => $dav_resource->dav_name()) );
277  require_once("instance_range.php");
278  update_instance_ranges($dav_resource->dav_name());
279  }
280  else {
281  add_failure('set', $tag, 'HTTP/1.1 409 Conflict', translate("calendar-timezone property is only valid for a calendar."));
282  }
283  break;
284 
288  case 'http://calendarserver.org/ns/:getctag':
289  case 'DAV::owner':
290  case 'DAV::principal-collection-set':
291  case 'urn:ietf:params:xml:ns:caldav:calendar-user-address-set':
292  case 'urn:ietf:params:xml:ns:caldav:schedule-inbox-URL':
293  case 'urn:ietf:params:xml:ns:caldav:schedule-outbox-URL':
294  case 'DAV::getetag':
295  case 'DAV::getcontentlength':
296  case 'DAV::getcontenttype':
297  case 'DAV::getlastmodified':
298  case 'DAV::creationdate':
299  case 'DAV::lockdiscovery':
300  case 'DAV::supportedlock':
301  case 'DAV::group-membership':
302  case 'http://calendarserver.org/ns/:calendar-proxy-read-for':
303  case 'http://calendarserver.org/ns/:calendar-proxy-write-for':
304  add_failure('set', $tag, 'HTTP/1.1 403 Forbidden', translate("Property is read-only"), 'cannot-modify-protected-property');
305  break;
306 
310  default:
311  $qry->QDo('SELECT set_dav_property( :dav_name, :user_no::integer, :tag::text, :value::text)',
312  array( ':dav_name' => $dav_resource->dav_name(), ':user_no' => $request->user_no, ':tag' => $tag, ':value' => $content) );
313  $result = $qry->Fetch();
314  if ( $result->set_dav_property ) {
315  $success[$tag] = 1;
316  } else {
317  dbg_error_log("ERROR", "failed to set_dav_property %s on %s to '%s'", $tag, $dav_resource->dav_name(), $content);
318  add_failure('set', $tag, 'HTTP/1.1 403 Forbidden');
319  }
320  break;
321  }
322 }
323 
324 foreach( $rmprops AS $k => $setting ) {
325  $tag = $setting->GetNSTag();
326  $content = $setting->RenderContent();
327 
328  switch( $tag ) {
329 
330  case 'DAV::resourcetype':
331  add_failure('rm', $tag, 'HTTP/1.1 403 Forbidden',
332  translate("DAV::resourcetype may only be set to a new value, it may not be removed."), 'cannot-modify-protected-property');
333  break;
334 
335  case 'DAV::group-member-set':
336  if ( $dav_resource->IsProxyCollection() ) {
337  $type = 'read';
338  $privileges = privilege_to_bits( array('read', 'read-free-busy', 'schedule-deliver') );
339  if ( $dav_resource->IsProxyCollection('write') ) {
340  $type = 'write';
341  $privileges |= privilege_to_bits( array('write', 'schedule-send') );
342  }
343 
344  $by_principal = $dav_resource->getProperty('principal_id');
345  $sqlparams = array( ':by_principal' => $by_principal );
346 
347  // look up existing grants of our type
348  $existing_grants = array();
349  $qry->QDo('SELECT privileges, to_principal FROM grants WHERE by_principal = :by_principal', $sqlparams);
350  while( $row = $qry->Fetch() ) {
351  $existing_privileges = bindec($row->privileges);
352  if ( ($existing_privileges & $privileges) == $privileges ) {
353  $existing_grants[$row->to_principal] = $existing_privileges;
354  }
355  }
356 
357  // examine the members to be removed
358  $group_members = $setting->GetElements('DAV::href');
359  foreach( $group_members AS $member ) {
360  $to_principal = new Principal('path', DeconstructURL( $member->GetContent() ));
361  // "Specifying the removal of a property that does not exist is not an error."
362  if ( !$to_principal->Exists() ) continue;
363  if ( !array_key_exists($to_principal->principal_id(), $existing_grants) ) continue;
364 
365  $remaining_privileges = $existing_grants[$to_principal->principal_id()] & ($privileges ^ DAVICAL_MAXPRIV);
366  if ($remaining_privileges > 0) {
367  $sql = 'UPDATE grants SET privileges=:privileges::INT::BIT(24) ';
368  $sqlparams[':privileges'] = $remaining_privileges;
369  } else {
370  $sql = 'DELETE FROM grants ';
371  }
372 
373  $sqlparams[':to_principal'] = $to_principal->principal_id();
374  $qry->QDo($sql.'WHERE by_principal = :by_principal AND to_principal = :to_principal', $sqlparams);
375 
376  dbg_error_log("PROPPATCH", "group-member-set: %s is no longer granted %s access to %s", $to_principal->username(), $type, $by_principal);
377  Principal::cacheFlush('principal_id = :to_principal', $sqlparams);
378  }
379  }
380  else {
381  /* @todo PROPPATCH remove group-member-set for regular group principal */
382  dbg_error_log("ERROR", "PROPPATCH: remove group-member-set for non-proxy collection: don't know what to do!");
383  add_failure('rm', $tag, 'HTTP/1.1 403 Forbidden',
384  'group-member-set ' . translate('unimplemented'), 'cannot-modify-protected-property');
385  break;
386  }
387  $success[$tag] = 1;
388  break;
389 
390  case 'urn:ietf:params:xml:ns:caldav:calendar-timezone':
391  if ( $dav_resource->IsCollection() && $dav_resource->IsCalendar() && ! $dav_resource->IsBinding() ) {
392  $qry->QDo('UPDATE collection SET timezone = NULL WHERE dav_name = :dav_name', array( ':dav_name' => $dav_resource->dav_name()) );
393  require_once("instance_range.php");
394  update_instance_ranges($dav_resource->dav_name());
395  }
396  else {
397  add_failure('rm', $tag, 'HTTP/1.1 403 Forbidden',
398  translate("calendar-timezone property is only valid for a calendar."), 'cannot-modify-protected-property');
399  }
400  break;
401 
405  case 'http://calendarserver.org/ns/:getctag':
406  case 'DAV::owner':
407  case 'DAV::principal-collection-set':
408  case 'urn:ietf:params:xml:ns:caldav:CALENDAR-USER-ADDRESS-SET':
409  case 'urn:ietf:params:xml:ns:caldav:schedule-inbox-URL':
410  case 'urn:ietf:params:xml:ns:caldav:schedule-outbox-URL':
411  case 'DAV::getetag':
412  case 'DAV::getcontentlength':
413  case 'DAV::getcontenttype':
414  case 'DAV::getlastmodified':
415  case 'DAV::creationdate':
416  case 'DAV::displayname':
417  case 'DAV::lockdiscovery':
418  case 'DAV::supportedlock':
419  case 'DAV::group-membership':
420  case 'http://calendarserver.org/ns/:calendar-proxy-read-for':
421  case 'http://calendarserver.org/ns/:calendar-proxy-write-for':
422  add_failure('rm', $tag, 'HTTP/1.1 409 Conflict', translate("Property is read-only"));
423  dbg_error_log( 'PROPPATCH', ' RMProperty %s is read only and cannot be removed', $tag);
424  break;
425 
429  default:
430  $qry->QDo('DELETE FROM property WHERE dav_name=:dav_name AND property_name=:property_name',
431  array( ':dav_name' => $dav_resource->dav_name(), ':property_name' => $tag) );
432  $success[$tag] = 1;
433  break;
434  }
435 }
436 
437 
441 if ( count($failure) > 0 ) {
442 
443  $qry->Rollback();
444 
445  $url = ConstructURL($request->path);
446  $multistatus = new XMLElement('multistatus');
447  array_unshift($failure,new XMLElement('responsedescription', translate("Some properties were not able to be changed.") ));
448  array_unshift($failure,new XMLElement('href', $url));
449  $response = $reply->DAVElement($multistatus,'response', $failure);
450 
451  if ( !empty($success) ) {
452  $prop = new XMLElement('prop');
453  foreach( $success AS $tag => $v ) {
454  $reply->NSElement($prop, $tag);
455  }
456  $reply->DAVElement($response, 'propstat', array( $prop, new XMLElement( 'status', 'HTTP/1.1 424 Failed Dependency' )) );
457  }
458  $request->DoResponse( 207, $reply->Render($multistatus), 'text/xml; charset="utf-8"' );
459 
460 }
461 
465 if ( $qry->Commit() ) {
466 
467  $cache = getCacheInstance();
468  $cache_ns = null;
469  if ( $dav_resource->IsPrincipal() ) {
470  $cache_ns = 'principal-'.$dav_resource->dav_name();
471  }
472  else if ( $dav_resource->IsCollection() ) {
473  // Uncache anything to do with the collection
474  $cache_ns = 'collection-'.$dav_resource->dav_name();
475  }
476 
477  if ( isset($cache_ns) ) $cache->delete( $cache_ns, null );
478 
479  if ( $request->PreferMinimal() ) {
480  $request->DoResponse(200); // Does not return.
481  }
482 
483  $url = ConstructURL($request->path);
484  $multistatus = new XMLElement('multistatus');
485  $response = $multistatus->NewElement('response');
486  $reply->DAVElement($response,'href', $url);
487  $reply->DAVElement($response,'responsedescription', translate("All requested changes were made.") );
488 
489  $prop = new XMLElement('prop');
490  foreach( $success AS $tag => $v ) {
491  $reply->NSElement($prop, $tag);
492  }
493  $reply->DAVElement($response, 'propstat', array( $prop, new XMLElement( 'status', 'HTTP/1.1 200 OK' )) );
494 
495  $url = ConstructURL($request->path);
496  array_unshift( $failure, new XMLElement('href', $url ) );
497 
498  $request->DoResponse( 207, $reply->Render($multistatus), 'text/xml; charset="utf-8"' );
499 }
500 
504 $request->DoResponse( 500 );
505 exit(0); // unneccessary
506