sascha
/
nextcloud-server
mirror of https://github.com/nextcloud/server.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix(dav): Handle long absence status earlier 

Validate the request early. Don't let this cause a database error.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
pull/51256/head
Christoph Wurst 2025-02-28 09:05:05 +07:00
parent a4760ef906
commit c91dee747b
No known key found for this signature in database
GPG Key ID: CC42AC2A7F0E56D8
2 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
apps/dav/lib/Controller/OutOfOfficeController.php
Unescape Escape View File

@ -21,6 +21,7 @@ use OCP\IRequest;
use OCP\IUserManager;
use OCP\IUserSession;
use OCP\User\IAvailabilityCoordinator;
use function mb_strlen;
/**
* @psalm-import-type DAVOutOfOfficeData from ResponseDefinitions
@ -107,10 +108,10 @@ class OutOfOfficeController extends OCSController {
* @param string $message Longer multiline message that is shown to others during the absence
* @param ?string $replacementUserId User id of the replacement user
* @param ?string $replacementUserDisplayName Display name of the replacement user
* @return DataResponse<Http::STATUS_OK, DAVOutOfOfficeData, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'firstDay'}, array{}>|DataResponse<Http::STATUS_UNAUTHORIZED, null, array{}>|DataResponse<Http::STATUS_NOT_FOUND, null, array{}>
* @return DataResponse<Http::STATUS_OK, DAVOutOfOfficeData, array{}>|DataResponse<Http::STATUS_BAD_REQUEST, array{error: 'firstDay'|'statusLength'}, array{}>|DataResponse<Http::STATUS_UNAUTHORIZED, null, array{}>|DataResponse<Http::STATUS_NOT_FOUND, null, array{}>
*
* 200: Absence data
* 400: When the first day is not before the last day
* 400: When validation fails, e.g. data range error or the first day is not before the last day
* 401: When the user is not logged in
* 404: When the replacementUserId was provided but replacement user was not found
*/
@ -128,6 +129,9 @@ class OutOfOfficeController extends OCSController {
if ($user === null) {
return new DataResponse(null, Http::STATUS_UNAUTHORIZED);
}
if (mb_strlen($status) > 100) {
return new DataResponse(['error' => 'statusLength'], Http::STATUS_BAD_REQUEST);
}
if ($replacementUserId !== null) {
$replacementUser = $this->userManager->get($replacementUserId);

5
apps/dav/openapi.json
Unescape Escape View File

@ -793,7 +793,7 @@
}
},
"400": {
"description": "When the first day is not before the last day",
"description": "When validation fails, e.g. data range error or the first day is not before the last day",
"content": {
"application/json": {
"schema": {
@ -821,7 +821,8 @@
"error": {
"type": "string",
"enum": [
"firstDay"
"firstDay",
"statusLength"
]
}
}