Overview

Packages

  • awl
    • caldav-client-v2
    • RRule
  • davical
    • authentication
      • drivers
    • caldav
    • DAViCalSession
    • DAVTicket
    • external-bind
    • feed
    • HTTPAuthSession
    • iSchedule
    • iSchedule-POST
    • logging
    • metrics
    • Principal
    • propfind
    • PublicSession
    • Request
    • Resource
    • tzservice
  • None
  • PHP

Functions

  • add_proxy_response
  • get_collection_contents
  • Overview
  • Package
  • Function
  • Tree
  • Deprecated
  • Todo
  1: <?php
  2: /**
  3: * CalDAV Server - handle PROPFIND method
  4: *
  5: * @package   davical
  6: * @subpackage   propfind
  7: * @author    Andrew McMillan <andrew@catalyst.net.nz>
  8: * @copyright Catalyst .Net Ltd, Andrew McMillan
  9: * @license   http://gnu.org/copyleft/gpl.html GNU GPL v2 or later
 10: */
 11: dbg_error_log('PROPFIND', 'method handler');
 12: 
 13: $request->NeedPrivilege( array('DAV::read', 'urn:ietf:params:xml:ns:caldav:read-free-busy','DAV::read-current-user-privilege-set') );
 14: 
 15: require_once('iCalendar.php');
 16: require_once('XMLDocument.php');
 17: require_once('DAVResource.php');
 18: 
 19: $reply = new XMLDocument( array( 'DAV:' => '' ) );
 20: 
 21: if ( !isset($request->xml_tags) ) {
 22:   // Empty body indicates DAV::allprop request according to RFC4918
 23:   $property_list = array('DAV::allprop');
 24: }
 25: else {
 26:   $position = 0;
 27:   $xmltree = BuildXMLTree( $request->xml_tags, $position);
 28:   if ( !is_object($xmltree) ) {
 29:     $request->DoResponse( 403, translate("Request body is not valid XML data!") );
 30:   }
 31:   $allprop    = $xmltree->GetPath('/DAV::propfind/*');
 32:   $property_list = array();
 33:   foreach( $allprop AS $k1 => $propwrap ) {
 34:     switch ( $propwrap->GetNSTag() ) {
 35:       case 'DAV::allprop':
 36:         $property_list[] = 'DAV::allprop';
 37:         break;
 38:       case 'DAV::propname':
 39:         $property_list[] = 'DAV::propname';
 40:         break;
 41:       default:  // prop, include
 42:         $subprop = $propwrap->GetElements();
 43:         foreach( $subprop AS $k => $v ) {
 44:           if ( is_object($v) && method_exists($v,'GetTag') ) $property_list[] = $v->GetNSTag();
 45:         }
 46:     }
 47:   }
 48: }
 49: 
 50: /**
 51:  * Add the calendar-proxy-read/write pseudocollections
 52:  * @param responses array of responses to which to add the collections
 53:  */
 54: function add_proxy_response( $which, $parent_path ) {
 55:   global $request, $reply, $c, $session, $property_list;
 56: 
 57:   if ($parent_path != $request->principal->dav_name()) {
 58:     dbg_error_log( 'PROPFIND', 'Not returning proxy response since "%s" != "%s"', $parent_path, $request->principal->dav_name() );
 59:     return null; // Nothing to proxy for
 60:   }
 61: 
 62:   $collection = (object) '';
 63:   if ( $which == 'read' ) {
 64:     $proxy_group = $request->principal->ReadProxyGroup();
 65:   } else if ( $which == 'write' ) {
 66:     $proxy_group = $request->principal->WriteProxyGroup();
 67:   }
 68: 
 69:   dbg_error_log( 'PROPFIND', 'Returning proxy response to "%s" for "%s"', $which, $parent_path );
 70: 
 71:   $collection->parent_container = $parent_path;
 72:   $collection->dav_name = $parent_path.'calendar-proxy-'.$which.'/';
 73:   $collection->is_calendar    = 'f';
 74:   $collection->is_addressbook = 'f';
 75:   $collection->is_principal   = 't';
 76:   $collection->is_proxy       = 't';
 77:   $collection->proxy_type     = $which;
 78:   $collection->type           = 'proxy';
 79:   $collection->dav_displayname = $collection->dav_name;
 80:   $collection->collection_id = 0;
 81:   $collection->user_no = $session->user_no;
 82:   $collection->username = $session->username;
 83:   $collection->email = $session->email;
 84:   $collection->created = date('Ymd\THis');
 85:   $collection->dav_etag = md5($c->system_name . $collection->dav_name . implode($proxy_group) );
 86:   $collection->proxy_for = $proxy_group;
 87:   $collection->resourcetypes  = sprintf('<DAV::collection/><http://calendarserver.org/ns/:calendar-proxy-%s/>', $which);
 88:   $collection->in_freebusy_set = 'f';
 89:   $collection->schedule_transp = 'transp';
 90:   $collection->timezone        = null;
 91:   $collection->description     = '';
 92: 
 93:   $resource = new DAVResource($collection);
 94:   return $resource->RenderAsXML($property_list, $reply);
 95: 
 96: }
 97: 
 98: 
 99: /**
100: * Get XML response for items in the collection
101: * If '/' is requested, a list of visible users is given, otherwise
102: * a list of calendars for the user which are parented by this path.
103: */
104: function get_collection_contents( $depth, $collection, $parent_path = null ) {
105:   global $c, $session, $request, $reply, $property_list;
106: 
107:   // for http header comparison
108:   function compare_val_with_re($val, $re){ return preg_match($re, $val)===1 ? 0 : 1; }
109: 
110:   $bound_from = $collection->bound_from();
111:   $bound_to   = $collection->dav_name();
112:   if ( !isset($parent_path) ) $parent_path = $collection->dav_name();
113:   dbg_error_log('PROPFIND','Getting collection contents: Depth %d, Path: %s, Bound from: %s, Bound to: %s',
114:                                                               $depth, $collection->dav_name(), $bound_from, $bound_to );
115: 
116:   $date_format = AwlDBDialect::HttpDateFormat;
117:   $responses = array();
118:   if ( ! $collection->IsCalendar() &&  ! $collection->IsAddressbook() ) {
119:     /**
120:     * Calendar/Addressbook collections may not contain collections, so we are only looking in the other ones
121:     */
122:     $params = array( ':session_principal' => $session->principal_id, ':scan_depth' => $c->permission_scan_depth );
123:     if ( $bound_from == '/' ) {
124:       $sql = "SELECT usr.*, '/' || username || '/' AS dav_name, md5(username || updated::text) AS dav_etag, ";
125:       $sql .= "to_char(joined at time zone 'GMT',$date_format) AS created, ";
126:       $sql .= "to_char(updated at time zone 'GMT',$date_format) AS modified, ";
127:       $sql .= 'FALSE AS is_calendar, TRUE AS is_principal, FALSE AS is_addressbook, \'principal\' AS type, ';
128:       $sql .= 'principal_id AS collection_id, ';
129:       $sql .= 'principal.* ';
130:       $sql .= 'FROM usr JOIN principal USING (user_no) ';
131:       $sql .= "WHERE (pprivs(:session_principal::int8,principal.principal_id,:scan_depth::int) & 1::BIT(24))::INT4::BOOLEAN ";
132:       $sql .= 'ORDER BY usr.user_no';
133:     }
134:     else {
135:       if ( !( isset($c->hide_bound) && (
136:               ((is_bool($c->hide_bound) || is_numeric($c->hide_bound)) && $c->hide_bound != false) ||
137:               (is_string($c->hide_bound) && preg_match($c->hide_bound, $_SERVER['HTTP_USER_AGENT'])) ||
138:               (is_array($c->hide_bound) && count(array_uintersect_assoc(
139:                 array_change_key_case(apache_request_headers(), CASE_LOWER),
140:                 array_change_key_case($c->hide_bound, CASE_LOWER),
141:                 'compare_val_with_re'))) ) ) ) {
142:         $qry = new AwlQuery('SELECT * FROM dav_binding WHERE dav_binding.parent_container = :this_dav_name ORDER BY bind_id',
143:                              array(':this_dav_name' => $bound_from));
144:         if( $qry->Exec('PROPFIND',__LINE__,__FILE__) && $qry->rows() > 0 ) {
145:           while( $binding = $qry->Fetch() ) {
146:             $resource = new DAVResource($binding->dav_name);
147:             if ( $resource->IsExternal() ) {
148:               require_once("external-fetch.php");
149:               update_external ( $resource );
150:             }
151:             if ( $resource->HavePrivilegeTo('DAV::read', false) ) {
152:               $resource->set_bind_location( str_replace($bound_from,$bound_to,$binding->dav_name));
153:               $responses[] = $resource->RenderAsXML($property_list, $reply);
154:               if ( $depth > 0 ) {
155:                 $responses = array_merge($responses, get_collection_contents( $depth - 1, $resource, $binding->dav_name ) );
156:               }
157:             }
158:           }
159:         }
160:       }
161: 
162:       $sql = 'SELECT principal.*, collection.*, \'collection\' AS type ';
163:       $sql .= 'FROM collection LEFT JOIN principal USING (user_no) ';
164:       $sql .= 'WHERE parent_container = :this_dav_name ';
165:       $sql .= ' ORDER BY collection_id';
166:       $params[':this_dav_name'] = $bound_from;
167:       unset($params[':session_principal']);
168:       unset($params[':scan_depth']);
169:     }
170:     $qry = new AwlQuery($sql, $params);
171: 
172:     if( $qry->Exec('PROPFIND',__LINE__,__FILE__) && $qry->rows() > 0 ) {
173:       while( $subcollection = $qry->Fetch() ) {
174:         $resource = new DAVResource($subcollection);
175:         if ( ! $resource->HavePrivilegeTo('DAV::read') ) continue;
176:         $resource->set_bind_location( str_replace($bound_from,$bound_to,$subcollection->dav_name));
177:         $responses[] = $resource->RenderAsXML($property_list, $reply);
178:         if ( $depth > 0 ) {
179:           $responses = array_merge($responses, get_collection_contents( $depth - 1, $resource,
180:                                                    str_replace($resource->parent_path(), $parent_path, $resource->dav_name() ) ) );
181:         }
182:       }
183:     }
184: 
185:     if ( !( (isset($c->disable_caldav_proxy) && $c->disable_caldav_proxy != false) ||
186:             (isset($c->disable_caldav_proxy_propfind_collections) && (
187:               ((is_bool($c->disable_caldav_proxy_propfind_collections) || is_numeric($c->disable_caldav_proxy_propfind_collections)) && $c->disable_caldav_proxy_propfind_collections != false) ||
188:               (is_string($c->disable_caldav_proxy_propfind_collections) && preg_match($c->disable_caldav_proxy_propfind_collections, $_SERVER['HTTP_USER_AGENT'])) ||
189:               (is_array($c->disable_caldav_proxy_propfind_collections) && count(array_uintersect_assoc(
190:                 array_change_key_case(apache_request_headers(), CASE_LOWER),
191:                 array_change_key_case($c->disable_caldav_proxy_propfind_collections, CASE_LOWER),
192:                 'compare_val_with_re')))) ) ) && $collection->IsPrincipal() ) {
193:       // Caldav Proxy: 5.1 par. 2: Add child resources calendar-proxy-(read|write)
194:       dbg_error_log('PROPFIND','Adding calendar-proxy-read and write. Path: %s', $bound_from );
195:       $response = add_proxy_response('read', $bound_from );
196:       if ( isset($response) ) $responses[] = $response;
197:       $response = add_proxy_response('write', $bound_from );
198:       if ( isset($response) ) $responses[] = $response;
199:     }
200:   }
201: 
202:   /**
203:   * freebusy permission is not allowed to see the items in a collection.  Must have at least read permission.
204:   */
205:   if ( $collection->HavePrivilegeTo('DAV::read', false) ) {
206:     dbg_error_log('PROPFIND','Getting collection items: Depth %d, Path: %s', $depth, $bound_from );
207:     $privacy_clause = ' ';
208:     $todo_clause = ' ';
209:     $time_limit_clause = ' ';
210:     if ( $collection->IsCalendar() ) {
211:       if ( ! $collection->HavePrivilegeTo('all', false) ) {
212:         $privacy_clause = " AND (calendar_item.class != 'PRIVATE' OR calendar_item.class IS NULL) ";
213:       }
214: 
215:       if ( isset($c->hide_TODO) && ($c->hide_TODO === true || (is_string($c->hide_TODO) && preg_match($c->hide_TODO, $_SERVER['HTTP_USER_AGENT']))) && ! $collection->HavePrivilegeTo('all') ) {
216:         $todo_clause = " AND caldav_data.caldav_type NOT IN ('VTODO') ";
217:       }
218: 
219:       if ( isset($c->hide_older_than) && intval($c->hide_older_than > 0) ) {
220:         $time_limit_clause = " AND (CASE WHEN caldav_data.caldav_type<>'VEVENT' OR calendar_item.dtstart IS NULL OR calendar_item.rrule IS NOT NULL THEN true ELSE calendar_item.dtstart > (now() - interval '".intval($c->hide_older_than)." days') END) ";
221:       }
222:     }
223: 
224:     $sql = 'SELECT collection.*, principal.*, calendar_item.*, caldav_data.*, ';
225:     $sql .= "to_char(coalesce(calendar_item.created, caldav_data.created) at time zone 'GMT',$date_format) AS created, ";
226:     $sql .= "to_char(coalesce(calendar_item.last_modified, caldav_data.modified) at time zone 'GMT',$date_format) AS modified, ";
227:     $sql .= 'summary AS dav_displayname ';
228:     $sql .= 'FROM caldav_data LEFT JOIN calendar_item USING( dav_id, user_no, dav_name, collection_id) ';
229:     $sql .= 'LEFT JOIN collection USING(collection_id,user_no) LEFT JOIN principal USING(user_no) ';
230:     $sql .= 'WHERE collection.dav_name = :collection_dav_name '.$time_limit_clause.' '.$todo_clause.' '.$privacy_clause;
231:     if ( isset($c->strict_result_ordering) && $c->strict_result_ordering ) $sql .= " ORDER BY caldav_data.dav_id";
232:     $qry = new AwlQuery( $sql, array( ':collection_dav_name' => $bound_from) );
233:     if( $qry->Exec('PROPFIND',__LINE__,__FILE__) && $qry->rows() > 0 ) {
234:       while( $item = $qry->Fetch() ) {
235:         if ( $bound_from != $bound_to ) {
236:           $item->bound_from = $item->dav_name;
237:           $item->dav_name = str_replace($bound_from,$bound_to,$item->dav_name);
238:         }
239:         $resource = new DAVResource($item);
240:         $responses[] = $resource->RenderAsXML($property_list, $reply, $parent_path );
241:       }
242:     }
243:   }
244: 
245:   return $responses;
246: }
247: 
248: 
249: 
250: /**
251: * Something that we can handle, at least roughly correctly.
252: */
253: $responses = array();
254: if ( $request->IsProxyRequest() ) {
255:   $response = add_proxy_response($request->proxy_type, $request->principal->dav_name() );
256:   if ( isset($response) ) $responses[] = $response;
257: }
258: else {
259:   $resource = new DAVResource($request->path);
260:   if ( ! $resource->Exists() ) {
261:     $request->PreconditionFailed( 404, 'must-exist', translate('That resource is not present on this server.') );
262:   }
263:   $resource->NeedPrivilege('DAV::read');
264:   if ( $resource->IsExternal() ) {
265:     require_once("external-fetch.php");
266:     update_external ( $resource );
267:   }
268:   if ( $resource->IsCollection() ) {
269:     dbg_error_log('PROPFIND','Getting collection contents: Depth %d, Path: %s', $request->depth, $resource->dav_name() );
270:     $responses[] = $resource->RenderAsXML($property_list, $reply);
271:     if ( $request->depth > 0 ) {
272:       $responses = array_merge($responses, get_collection_contents( $request->depth - 1, $resource ) );
273:     }
274:   }
275:   elseif ( $request->HavePrivilegeTo('DAV::read',false) ) {
276:     $responses[] = $resource->RenderAsXML($property_list, $reply);
277:   }
278: }
279: 
280: $xmldoc = $reply->Render('multistatus', $responses);
281: $etag = md5($xmldoc);
282: header('ETag: "'.$etag.'"');
283: $request->DoResponse( 207, $xmldoc, 'text/xml; charset="utf-8"' );
284: 
285: 
DAViCal API documentation generated by ApiGen 2.8.0