Skip to content

fix: sanitize attendee status on create and specific changes#47308

Draft
SebastianKrupinski wants to merge 2 commits intomasterfrom
fix/issue-13862
Draft

fix: sanitize attendee status on create and specific changes#47308
SebastianKrupinski wants to merge 2 commits intomasterfrom
fix/issue-13862

Conversation

@SebastianKrupinski
Copy link
Contributor

@SebastianKrupinski SebastianKrupinski commented Aug 17, 2024

Summary

TODO

  • Tests

Checklist

@SebastianKrupinski
fix: sanitize attendee status on create and specific changes
de66d2f 
Signed-off-by: SebastianKrupinski <krupinskis05@gmail.com>
github-advanced-security[bot]
github-advanced-security bot found potential problems Aug 17, 2024
View reviewed changes
apps/dav/lib/CalDAV/Plugin.php
* @param mixed $modified
* @param mixed $isNew
*/
public function calendarObjectChange(RequestInterface $request, ResponseInterface $response, VCalendar $alteredObject, $calendarPath, &$modified, $isNew) {

Check notice

Code scanning / Psalm

MissingReturnType

Method OCA\DAV\CalDAV\Plugin::calendarObjectChange does not have a return type, expecting void
apps/dav/lib/CalDAV/Plugin.php
// determine if altered calendar event is a new
// if calendar event is new sanitize and exit
if ($isNew) {
$this->sanitizeCreatedInstance($alteredObject->VEVENT, $modified);

Check failure

Code scanning / Psalm

InvalidArgument

Argument 1 of OCA\DAV\CalDAV\Plugin::sanitizeCreatedInstance expects Sabre\VObject\Component\VEvent, but Sabre\VObject\Property provided
apps/dav/lib/CalDAV/Plugin.php
/** @var \Sabre\VObject\Component\VCalendar $currentObject */
$currentObject = Reader::read($currentNode->get());
// find what has changed (base, recurrence, both) between altered and current calendar event
$delta = $this->findEventInstanceDelta($alteredObject->VEVENT, $currentObject->VEVENT);

Check failure

Code scanning / Psalm

InvalidArgument

Argument 1 of OCA\DAV\CalDAV\Plugin::findEventInstanceDelta expects Sabre\VObject\Component\VEvent, but Sabre\VObject\Property provided
apps/dav/lib/CalDAV/Plugin.php
/** @var \Sabre\VObject\Component\VCalendar $currentObject */
$currentObject = Reader::read($currentNode->get());
// find what has changed (base, recurrence, both) between altered and current calendar event
$delta = $this->findEventInstanceDelta($alteredObject->VEVENT, $currentObject->VEVENT);

Check failure

Code scanning / Psalm

InvalidArgument

Argument 2 of OCA\DAV\CalDAV\Plugin::findEventInstanceDelta expects Sabre\VObject\Component\VEvent, but Sabre\VObject\Property|null provided
apps/dav/lib/CalDAV/Plugin.php

}

public function sanitizeCreatedInstance(VEvent $altered, $modified): void {

Check notice

Code scanning / Psalm

MissingParamType

Parameter $modified has no provided type
apps/dav/lib/CalDAV/Plugin.php
public function sanitizeEventAttendees(VEvent $event, $modified): void {

// iterate thought attendees
foreach ($event->ATTENDEE as $id => $entry) {

Check notice

Code scanning / Psalm

PossiblyNullIterator

Cannot iterate over nullable var Sabre\VObject\Property|null
apps/dav/lib/CalDAV/Plugin.php
// determine attendee participation status
// if status is missing or NOT set correctly change the status
if (!isset($entry['PARTSTAT']) || $entry['PARTSTAT']->getValue() !== 'NEEDS-ACTION') {
$event->ATTENDEE[$id]['PARTSTAT']->setValue('NEEDS-ACTION');

Check failure

Code scanning / Psalm

InvalidArgument

Argument 1 of Sabre\VObject\Node::offsetGet expects int, but 'PARTSTAT' provided
apps/dav/lib/CalDAV/Plugin.php
// determine if id exists in list
if (isset($list[$id])) {
// compare altered instance to current instance
if ($list[$id]['altered']->{'LAST-MODIFIED'}->getValue() == $event->{'LAST-MODIFIED'}->getValue() &&

Check notice

Code scanning / Psalm

PossiblyNullReference

Cannot call method getValue on possibly null value
apps/dav/lib/CalDAV/Plugin.php
if (isset($list[$id])) {
// compare altered instance to current instance
if ($list[$id]['altered']->{'LAST-MODIFIED'}->getValue() == $event->{'LAST-MODIFIED'}->getValue() &&
$list[$id]['altered']->SEQUENCE->getValue() == $event->SEQUENCE->getValue()) {

Check notice

Code scanning / Psalm

PossiblyNullPropertyFetch

Cannot get property on possibly null variable $list[$id]['altered'] of type mixed|null
apps/dav/lib/CalDAV/Plugin.php
if (isset($list[$id])) {
// compare altered instance to current instance
if ($list[$id]['altered']->{'LAST-MODIFIED'}->getValue() == $event->{'LAST-MODIFIED'}->getValue() &&
$list[$id]['altered']->SEQUENCE->getValue() == $event->SEQUENCE->getValue()) {

Check notice

Code scanning / Psalm

PossiblyNullReference

Cannot call method getValue on possibly null value
@SebastianKrupinski
Copy link
Contributor Author

SebastianKrupinski commented Aug 17, 2024 •
edited
Loading

Testing Steps

Create Test

  1. Using external tool PUT a new event with invalid attendee participant status e.g (Accepted)

Attendee participation status should be reset to "NEEDS-ACTION"

Update Test

  1. Create a singleton event with attendees.
  2. Accept event as attendee.
  3. Change event Start, End, Location or Recurrence.
  4. Repeat 1 to 3 with a recurring event

Attendee participation status should be reset to "NEEDS-ACTION"

@SebastianKrupinski SebastianKrupinski added the 2. developing Work in progress label Aug 17, 2024
@SebastianKrupinski SebastianKrupinski self-assigned this Aug 17, 2024
@SebastianKrupinski
fix: sanitize attendee status on create and specific changes
71c502d 
Signed-off-by: SebastianKrupinski <krupinskis05@gmail.com>
@tcitworld
Copy link
Member

tcitworld commented Aug 18, 2024

For reference: #42347

@ChristophWurst ChristophWurst marked this pull request as draft August 19, 2024 06:36
@skjnldsv skjnldsv added this to the Nextcloud 32 milestone Jan 30, 2025
@skjnldsv skjnldsv modified the milestones: Nextcloud 32, Nextcloud 33 Sep 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ChristophWurst ChristophWurst Awaiting requested review from ChristophWurst ChristophWurst is a code owner

@miaulalala miaulalala Awaiting requested review from miaulalala

@tcitworld tcitworld Awaiting requested review from tcitworld tcitworld is a code owner

At least 2 approving reviews are required to merge this pull request.

Assignees

@SebastianKrupinski SebastianKrupinski

Labels

2. developing Work in progress blocked

Projects

💌 📅 👥 Groupware team
Status: 🏗️ In progress

Milestone

Nextcloud 33

Development

Successfully merging this pull request may close these issues.

After organizer moves event, attendee status is still "accepted", should be "needs-action"

3 participants

@SebastianKrupinski @tcitworld @skjnldsv