From 827c0980d800ac88f79ea6f11c77dad5bc4ca170 Mon Sep 17 00:00:00 2001 From: Christoph Wurst Date: Mon, 9 Mar 2020 13:36:27 +0100 Subject: [PATCH] Prevent creation of reserved address book name Signed-off-by: Christoph Wurst --- apps/dav/lib/CardDAV/UserAddressBooks.php | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/apps/dav/lib/CardDAV/UserAddressBooks.php b/apps/dav/lib/CardDAV/UserAddressBooks.php index f3803cf169..8b9e22db5a 100644 --- a/apps/dav/lib/CardDAV/UserAddressBooks.php +++ b/apps/dav/lib/CardDAV/UserAddressBooks.php @@ -28,9 +28,12 @@ declare(strict_types=1); namespace OCA\DAV\CardDAV; use OCA\DAV\AppInfo\PluginManager; +use OCA\DAV\CardDAV\Integration\ExternalAddressBook; use OCP\IConfig; use OCP\IL10N; use Sabre\CardDAV\Backend; +use Sabre\DAV\Exception\MethodNotAllowed; +use Sabre\DAV\MkCol; class UserAddressBooks extends \Sabre\CardDAV\AddressBookHome { @@ -78,6 +81,14 @@ class UserAddressBooks extends \Sabre\CardDAV\AddressBookHome { } + public function createExtendedCollection($name, MkCol $mkCol) { + if (ExternalAddressBook::doesViolateReservedName($name)) { + throw new MethodNotAllowed('The resource you tried to create has a reserved name'); + } + + parent::createExtendedCollection($name, $mkCol); + } + /** * Returns a list of ACE's for this node. *