inc/caldav-PROPFIND.php

   1 <?php
   2 /**
   3 * CalDAV Server - handle PROPFIND method
   4 *
   5 * @package   davical
   6 * @subpackage   propfind
   7 * @author    Andrew McMillan <andrew@catalyst.net.nz>
   8 * @copyright Catalyst .Net Ltd, Andrew McMillan
   9 * @license   http://gnu.org/copyleft/gpl.html GNU GPL v2 or later
  10 */
  11 dbg_error_log('PROPFIND', 'method handler');
  12
  13 $request->NeedPrivilege( array('DAV::read', 'urn:ietf:params:xml:ns:caldav:read-free-busy','DAV::read-current-user-privilege-set') );
  14
  15 require_once('iCalendar.php');
  16 require_once('XMLDocument.php');
  17 require_once('DAVResource.php');
  18
  19 $reply = new XMLDocument( array( 'DAV:' => '' ) );
  20
  21 if ( !isset($request->xml_tags) ) {
  22   // Empty body indicates DAV::allprop request according to RFC4918
  23   $property_list = array('DAV::allprop');
  24 }
  25 else {
  26   $position = 0;
  27   $xmltree = BuildXMLTree( $request->xml_tags, $position);
  28   if ( !is_object($xmltree) ) {
  29     $request->DoResponse( 403, translate("Request body is not valid XML data!") );
  30   }
  31   $allprop    = $xmltree->GetPath('/DAV::propfind/*');
  32   $property_list = array();
  33   foreach( $allprop AS $k1 => $propwrap ) {
  34     switch ( $propwrap->GetNSTag() ) {
  35       case 'DAV::allprop':
  36         $property_list[] = 'DAV::allprop';
  37         break;
  38       case 'DAV::propname':
  39         $property_list[] = 'DAV::propname';
  40         break;
  41       default:  // prop, include
  42         $subprop = $propwrap->GetElements();
  43         foreach( $subprop AS $k => $v ) {
  44           if ( is_object($v) && method_exists($v,'GetTag') ) $property_list[] = $v->GetNSTag();
  45         }
  46     }
  47   }
  48 }
  49
  50 /**
  51  * Add the calendar-proxy-read/write pseudocollections
  52  * @param responses array of responses to which to add the collections
  53  */
  54 function add_proxy_response( $which, $parent_path ) {
  55   global $request, $reply, $c, $session, $property_list;
  56
  57   if ($parent_path != $request->principal->dav_name()) {
  58     dbg_error_log( 'PROPFIND', 'Not returning proxy response since "%s" != "%s"', $parent_path, $request->principal->dav_name() );
  59     return null; // Nothing to proxy for
  60   }
  61
  62   $collection = (object) '';
  63   if ( $which == 'read' ) {
  64     $proxy_group = $request->principal->ReadProxyGroup();
  65   } else if ( $which == 'write' ) {
  66     $proxy_group = $request->principal->WriteProxyGroup();
  67   }
  68
  69   dbg_error_log( 'PROPFIND', 'Returning proxy response to "%s" for "%s"', $which, $parent_path );
  70
  71   $collection->parent_container = $parent_path;
  72   $collection->dav_name = $parent_path.'calendar-proxy-'.$which.'/';
  73   $collection->is_calendar    = 'f';
  74   $collection->is_addressbook = 'f';
  75   $collection->is_principal   = 't';
  76   $collection->is_proxy       = 't';
  77   $collection->proxy_type     = $which;
  78   $collection->type           = 'proxy';
  79   $collection->dav_displayname = $collection->dav_name;
  80   $collection->collection_id = 0;
  81   $collection->user_no = $session->user_no;
  82   $collection->username = $session->username;
  83   $collection->email = $session->email;
  84   $collection->created = date('Ymd\THis');
  85   $collection->dav_etag = md5($c->system_name . $collection->dav_name . implode($proxy_group) );
  86   $collection->proxy_for = $proxy_group;
  87   $collection->resourcetypes  = sprintf('<DAV::collection/><http://calendarserver.org/ns/:calendar-proxy-%s/>', $which);
  88   $collection->in_freebusy_set = 'f';
  89   $collection->schedule_transp = 'transp';
  90   $collection->timezone        = null;
  91   $collection->description     = '';
  92
  93   $resource = new DAVResource($collection);
  94   return $resource->RenderAsXML($property_list, $reply);
  95
  96 }
  97
  98
  99 /**
 100 * Get XML response for items in the collection
 101 * If '/' is requested, a list of visible users is given, otherwise
 102 * a list of calendars for the user which are parented by this path.
 103 */
 104 function get_collection_contents( $depth, $collection, $parent_path = null ) {
 105   global $c, $session, $request, $reply, $property_list;
 106
 107   $bound_from = $collection->bound_from();
 108   $bound_to   = $collection->dav_name();
 109   if ( !isset($parent_path) ) $parent_path = $collection->dav_name();
 110   dbg_error_log('PROPFIND','Getting collection contents: Depth %d, Path: %s, Bound from: %s, Bound to: %s',
 111                                                               $depth, $collection->dav_name(), $bound_from, $bound_to );
 112
 113   $date_format = AwlDatabase::HttpDateFormat;
 114   $responses = array();
 115   if ( ! $collection->IsCalendar() &&  ! $collection->IsAddressbook() ) {
 116     /**
 117     * Calendar/Addressbook collections may not contain collections, so we are only looking in the other ones
 118     */
 119     $params = array( ':session_principal' => $session->principal_id, ':scan_depth' => $c->permission_scan_depth );
 120     if ( $bound_from == '/' ) {
 121       $sql = "SELECT usr.*, '/' || username || '/' AS dav_name, md5(username || updated::text) AS dav_etag, ";
 122       $sql .= "to_char(joined at time zone 'GMT',$date_format) AS created, ";
 123       $sql .= "to_char(updated at time zone 'GMT',$date_format) AS modified, ";
 124       $sql .= 'FALSE AS is_calendar, TRUE AS is_principal, FALSE AS is_addressbook, \'principal\' AS type, ';
 125       $sql .= 'principal_id AS collection_id, ';
 126       $sql .= 'principal.* ';
 127       $sql .= 'FROM usr JOIN principal USING (user_no) ';
 128       $sql .= "WHERE (pprivs(:session_principal::int8,principal.principal_id,:scan_depth::int) & 1::BIT(24))::INT4::BOOLEAN ";
 129       $sql .= 'ORDER BY usr.user_no';
 130     }
 131     else {
 132       $qry = new AwlQuery('SELECT * FROM dav_binding WHERE dav_binding.parent_container = :this_dav_name ORDER BY bind_id',
 133                            array(':this_dav_name' => $bound_from));
 134       if( $qry->Exec('PROPFIND',__LINE__,__FILE__) && $qry->rows() > 0 ) {
 135         while( $binding = $qry->Fetch() ) {
 136           $resource = new DAVResource($binding->dav_name);
 137                                         if ( $resource->IsExternal() ) {
 138                                                 require_once("external-fetch.php");
 139                                                 update_external ( $resource );
 140                                         }
 141           if ( $resource->HavePrivilegeTo('DAV::read', false) ) {
 142             $resource->set_bind_location( str_replace($bound_from,$bound_to,$binding->dav_name));
 143             $responses[] = $resource->RenderAsXML($property_list, $reply);
 144             if ( $depth > 0 ) {
 145               $responses = array_merge($responses, get_collection_contents( $depth - 1, $resource, $binding->dav_name ) );
 146             }
 147           }
 148         }
 149       }
 150
 151       $sql = 'SELECT principal.*, collection.*, \'collection\' AS type ';
 152       $sql .= 'FROM collection LEFT JOIN principal USING (user_no) ';
 153       $sql .= 'WHERE parent_container = :this_dav_name ';
 154       $sql .= ' ORDER BY collection_id';
 155       $params[':this_dav_name'] = $bound_from;
 156       unset($params[':session_principal']);
 157       unset($params[':scan_depth']);
 158     }
 159     $qry = new AwlQuery($sql, $params);
 160
 161     if( $qry->Exec('PROPFIND',__LINE__,__FILE__) && $qry->rows() > 0 ) {
 162       while( $subcollection = $qry->Fetch() ) {
 163         $resource = new DAVResource($subcollection);
 164         if ( ! $resource->HavePrivilegeTo('DAV::read') ) continue;
 165         $resource->set_bind_location( str_replace($bound_from,$bound_to,$subcollection->dav_name));
 166         $responses[] = $resource->RenderAsXML($property_list, $reply);
 167         if ( $depth > 0 ) {
 168           $responses = array_merge($responses, get_collection_contents( $depth - 1, $resource,
 169                                                    str_replace($resource->parent_path(), $parent_path, $resource->dav_name() ) ) );
 170         }
 171       }
 172     }
 173
 174     if ( (!isset($c->disable_caldav_proxy) || $c->disable_caldav_proxy == false) && $collection->IsPrincipal() ) {
 175       // Caldav Proxy: 5.1 par. 2: Add child resources calendar-proxy-(read|write)
 176       dbg_error_log('PROPFIND','Adding calendar-proxy-read and write. Path: %s', $bound_from );
 177       $response = add_proxy_response('read', $bound_from );
 178       if ( isset($response) ) $responses[] = $response;
 179       $response = add_proxy_response('write', $bound_from );
 180       if ( isset($response) ) $responses[] = $response;
 181     }
 182   }
 183
 184   /**
 185   * freebusy permission is not allowed to see the items in a collection.  Must have at least read permission.
 186   */
 187   if ( $collection->HavePrivilegeTo('DAV::read', false) ) {
 188     dbg_error_log('PROPFIND','Getting collection items: Depth %d, Path: %s', $depth, $bound_from );
 189     $privacy_clause = ' ';
 190     $todo_clause = ' ';
 191     $time_limit_clause = ' ';
 192     if ( $collection->IsCalendar() ) {
 193       if ( ! $collection->HavePrivilegeTo('all', false) ) {
 194         $privacy_clause = " AND (calendar_item.class != 'PRIVATE' OR calendar_item.class IS NULL) ";
 195       }
 196
 197       if ( isset($c->hide_TODO) && ($c->hide_TODO === true || (is_string($c->hide_TODO) && preg_match($c->hide_TODO, $_SERVER['HTTP_USER_AGENT']))) && ! $collection->HavePrivilegeTo('all') ) {
 198         $todo_clause = " AND caldav_data.caldav_type NOT IN ('VTODO') ";
 199       }
 200
 201       if ( isset($c->hide_older_than) && intval($c->hide_older_than > 0) ) {
 202         $time_limit_clause = " AND (CASE WHEN caldav_data.caldav_type<>'VEVENT' OR calendar_item.dtstart IS NULL THEN true ELSE calendar_item.dtstart > (now() - interval '".intval($c->hide_older_than)." days') END) ";
 203       }
 204     }
 205
 206     $sql = 'SELECT collection.*, principal.*, calendar_item.*, caldav_data.*, ';
 207     $sql .= "to_char(coalesce(calendar_item.created, caldav_data.created) at time zone 'GMT',$date_format) AS created, ";
 208     $sql .= "to_char(coalesce(calendar_item.last_modified, caldav_data.modified) at time zone 'GMT',$date_format) AS modified, ";
 209     $sql .= 'summary AS dav_displayname ';
 210     $sql .= 'FROM caldav_data LEFT JOIN calendar_item USING( dav_id, user_no, dav_name, collection_id) ';
 211     $sql .= 'LEFT JOIN collection USING(collection_id,user_no) LEFT JOIN principal USING(user_no) ';
 212     $sql .= 'WHERE collection.dav_name = :collection_dav_name '.$time_limit_clause.' '.$todo_clause.' '.$privacy_clause;
 213     if ( isset($c->strict_result_ordering) && $c->strict_result_ordering ) $sql .= " ORDER BY caldav_data.dav_id";
 214     $qry = new AwlQuery( $sql, array( ':collection_dav_name' => $bound_from) );
 215     if( $qry->Exec('PROPFIND',__LINE__,__FILE__) && $qry->rows() > 0 ) {
 216       while( $item = $qry->Fetch() ) {
 217         if ( $bound_from != $bound_to ) {
 218           $item->bound_from = $item->dav_name;
 219           $item->dav_name = str_replace($bound_from,$bound_to,$item->dav_name);
 220         }
 221         $resource = new DAVResource($item);
 222         $responses[] = $resource->RenderAsXML($property_list, $reply, $parent_path );
 223       }
 224     }
 225   }
 226
 227   return $responses;
 228 }
 229
 230
 231
 232 /**
 233 * Something that we can handle, at least roughly correctly.
 234 */
 235 $responses = array();
 236 if ( $request->IsProxyRequest() ) {
 237   $response = add_proxy_response($request->proxy_type, $request->principal->dav_name() );
 238   if ( isset($response) ) $responses[] = $response;
 239 }
 240 else {
 241   $resource = new DAVResource($request->path);
 242   if ( ! $resource->Exists() ) {
 243     $request->PreconditionFailed( 404, 'must-exist', translate('That resource is not present on this server.') );
 244   }
 245   $resource->NeedPrivilege('DAV::read');
 246         if ( $resource->IsExternal() ) {
 247                 require_once("external-fetch.php");
 248                 update_external ( $resource );
 249         }
 250   if ( $resource->IsCollection() ) {
 251     dbg_error_log('PROPFIND','Getting collection contents: Depth %d, Path: %s', $request->depth, $resource->dav_name() );
 252     $responses[] = $resource->RenderAsXML($property_list, $reply);
 253     if ( $request->depth > 0 ) {
 254       $responses = array_merge($responses, get_collection_contents( $request->depth - 1, $resource ) );
 255     }
 256   }
 257   elseif ( $request->HavePrivilegeTo('DAV::read',false) ) {
 258     $responses[] = $resource->RenderAsXML($property_list, $reply);
 259   }
 260 }
 261
 262 $xmldoc = $reply->Render('multistatus', $responses);
 263 $etag = md5($xmldoc);
 264 header('ETag: "'.$etag.'"');
 265 $request->DoResponse( 207, $xmldoc, 'text/xml; charset="utf-8"' );
 266