inc/caldav-PROPPATCH.php

   1 <?php
   2 /**
   3 * CalDAV Server - handle PROPPATCH method
   4 *
   5 * @package   davical
   6 * @subpackage   caldav
   7 * @author    Andrew McMillan <andrew@mcmillan.net.nz>
   8 * @copyright Morphoss Ltd - http://www.morphoss.com/
   9 * @license   http://gnu.org/copyleft/gpl.html GNU GPL v2
  10 */
  11 dbg_error_log("PROPPATCH", "method handler");
  12
  13 require_once('vCalendar.php');
  14 require_once('DAVResource.php');
  15
  16 $dav_resource = new DAVResource($request->path);
  17 if ( !$dav_resource->HavePrivilegeTo('DAV::write-properties') ) {
  18   $parent = $dav_resource->GetParentContainer();
  19   if ( !$dav_resource->IsBinding() || !$parent->HavePrivilegeTo('DAV::write') ) {
  20     $request->PreconditionFailed(403, 'DAV::write-properties', 'You do not have permission to write properties to that resource' );
  21   }
  22 }
  23
  24 $position = 0;
  25 $xmltree = BuildXMLTree( $request->xml_tags, $position);
  26
  27 // echo $xmltree->Render();
  28
  29 if ( $xmltree->GetTag() != "DAV::propertyupdate" ) {
  30   $request->PreconditionFailed( 403, 'DAV::propertyupdate', 'XML request did not contain a &lt;propertyupdate&gt; tag' );
  31 }
  32
  33 /**
  34 * Find the properties being set, and the properties being removed
  35 */
  36 $setprops = $xmltree->GetPath("/DAV::propertyupdate/DAV::set/DAV::prop/*");
  37 $rmprops  = $xmltree->GetPath("/DAV::propertyupdate/DAV::remove/DAV::prop/*");
  38
  39 /**
  40 * We build full status responses for failures.  For success we just record
  41 * it, since the multistatus response only applies to failure.  While it is
  42 * not explicitly stated in RFC2518, from reading between the lines (8.2.1)
  43 * a success will return 200 OK [with an empty response].
  44 */
  45 $failure   = array();
  46 $success   = array();
  47
  48 /**
  49 * Not much for it but to process the incoming settings in a big loop, doing
  50 * the special-case stuff as needed and falling through to a default which
  51 * stuffs the property somewhere we will be able to retrieve it from later.
  52 */
  53 $qry = new AwlQuery();
  54 $qry->Begin();
  55 $setcalendar = count($xmltree->GetPath('/DAV::propertyupdate/DAV::set/DAV::prop/DAV::resourcetype/urn:ietf:params:xml:ns:caldav:calendar'));
  56 foreach( $setprops AS $k => $setting ) {
  57   $tag = $setting->GetTag();
  58   $content = $setting->RenderContent();
  59
  60   switch( $tag ) {
  61
  62     case 'DAV::displayname':
  63       /**
  64       * Can't set displayname on resources - only collections or principals
  65       */
  66       if ( $dav_resource->IsCollection() || $dav_resource->IsPrincipal() ) {
  67         if ( $dav_resource->IsBinding() ) {
  68           $qry->QDo('UPDATE dav_binding SET dav_displayname = :displayname WHERE dav_name = :dav_name',
  69                                             array( ':displayname' => $content, ':dav_name' => $dav_resource->dav_name()) );
  70         }
  71         else if ( $dav_resource->IsPrincipal() ) {
  72           $qry->QDo('UPDATE dav_principal SET fullname = :displayname, displayname = :displayname, modified = current_timestamp WHERE user_no = :user_no',
  73                                             array( ':displayname' => $content, ':user_no' => $request->user_no) );
  74         }
  75         else {
  76           $qry->QDo('UPDATE collection SET dav_displayname = :displayname, modified = current_timestamp WHERE dav_name = :dav_name',
  77                                             array( ':displayname' => $content, ':dav_name' => $dav_resource->dav_name()) );
  78         }
  79         $success[$tag] = 1;
  80       }
  81       else {
  82         $failure['set-'.$tag] = new XMLElement( 'propstat', array(
  83             new XMLElement( 'prop', new XMLElement($tag)),
  84             new XMLElement( 'status', 'HTTP/1.1 403 Forbidden' ),
  85             new XMLElement( 'responsedescription', array(
  86                               new XMLElement( 'error', new XMLElement( 'cannot-modify-protected-property') ),
  87                               translate("The displayname may only be set on collections, principals or bindings.") )
  88                           )
  89
  90         ));
  91       }
  92       break;
  93
  94     case 'DAV::resourcetype':
  95       /**
  96       * We only allow resourcetype setting on a normal collection, and not on a resource, a principal or a bind.
  97       * Only collections may be CalDAV calendars or addressbooks, and they may not be both.
  98       */
  99       $setcollection  = count($setting->GetPath('DAV::resourcetype/DAV::collection'));
 100       $setaddressbook = count($setting->GetPath('DAV::resourcetype/urn:ietf:params:xml:ns:carddav:addressbook'));
 101       if ( $dav_resource->IsCollection() && $setcollection && ! $dav_resource->IsPrincipal()
 102                             && ! $dav_resource->IsBinding() && ! ($setaddressbook && $setcalendar) ) {
 103         $resourcetypes = $setting->GetPath('DAV::resourcetype/*');
 104         $resourcetypes = str_replace( "\n", "", implode('',$resourcetypes));
 105         $qry->QDo('UPDATE collection SET is_calendar = :is_calendar::boolean, is_addressbook = :is_addressbook::boolean,
 106                      resourcetypes = :resourcetypes WHERE dav_name = :dav_name',
 107                     array( ':dav_name' => $dav_resource->dav_name(), ':resourcetypes' => $resourcetypes,
 108                            ':is_calendar' => $setcalendar, ':is_addressbook' => $setaddressbook ) );
 109         $success[$tag] = 1;
 110       }
 111       else {
 112         $failure['set-'.$tag] = new XMLElement( 'propstat', array(
 113             new XMLElement( 'prop', new XMLElement($tag)),
 114             new XMLElement( 'status', 'HTTP/1.1 403 Forbidden' ),
 115             new XMLElement( 'responsedescription', array(
 116                               new XMLElement( 'error', new XMLElement( 'cannot-modify-protected-property') ),
 117                               translate("Resources may not be changed to / from collections.") )
 118                           )
 119         ));
 120       }
 121       break;
 122
 123     case 'urn:ietf:params:xml:ns:caldav:schedule-calendar-transp':
 124       if ( $dav_resource->IsCollection() && ( $dav_resource->IsCalendar() || $setcalendar ) && !$dav_resource->IsBinding() ) {
 125         $transparency = $setting->GetPath('urn:ietf:params:xml:ns:caldav:schedule-calendar-transp/*');
 126         $transparency = preg_replace( '{^.*:}', '', $transparency[0]->GetTag());
 127         $qry->QDo('UPDATE collection SET schedule_transp = :transparency WHERE dav_name = :dav_name',
 128                     array( ':dav_name' => $dav_resource->dav_name(), ':transparency' => $transparency ) );
 129         $success[$tag] = 1;
 130       }
 131       else {
 132         $failure['set-'.$tag] = new XMLElement( 'propstat', array(
 133             new XMLElement( 'prop', new XMLElement($tag)),
 134               new XMLElement( 'status', 'HTTP/1.1 403 Forbidden' ),
 135               new XMLElement( 'responsedescription', array(
 136                                 new XMLElement( 'error', new XMLElement( 'cannot-modify-protected-property') ),
 137                                 translate("The CalDAV:schedule-calendar-transp property may only be set on calendars.") )
 138                             )
 139         ));
 140       }
 141       break;
 142
 143     case 'urn:ietf:params:xml:ns:caldav:calendar-free-busy-set':
 144       $failure['set-'.$tag] = new XMLElement( 'propstat', array(
 145           new XMLElement( 'prop', new XMLElement($tag)),
 146           new XMLElement( 'status', 'HTTP/1.1 409 Conflict' ),
 147           new XMLElement( 'responsedescription', translate("The calendar-free-busy-set is superseded by the schedule-transp property of a calendar collection.") )
 148       ));
 149       break;
 150
 151     case 'urn:ietf:params:xml:ns:caldav:calendar-timezone':
 152       if ( $dav_resource->IsCollection() && $dav_resource->IsCalendar() && ! $dav_resource->IsBinding() ) {
 153         $tzcomponent = $setting->GetPath('urn:ietf:params:xml:ns:caldav:calendar-timezone');
 154         $tzstring = $tzcomponent[0]->GetContent();
 155         $calendar = new vCalendar( $tzstring );
 156         $timezones = $calendar->GetComponents('VTIMEZONE');
 157         if ( count($timezones) == 0 ) break;
 158         $tz = $timezones[0];  // Backward compatibility
 159         $tzid = $tz->GetPValue('TZID');
 160         $params = array( ':tzid' => $tzid );
 161         $qry = new AwlQuery('SELECT 1 FROM timezones WHERE tzid = :tzid', $params );
 162         if ( $qry->Exec('PUT',__LINE__,__FILE__) && $qry->rows() == 0 ) {
 163           $params[':olson_name'] = $calendar->GetOlsonName($tz);
 164           $params[':vtimezone'] = (isset($tz) ? $tz->Render() : null );
 165           $qry->QDo('INSERT INTO timezones (tzid, olson_name, active, vtimezone) VALUES(:tzid,:olson_name,false,:vtimezone)', $params );
 166         }
 167
 168         $qry->QDo('UPDATE collection SET timezone = :tzid WHERE dav_name = :dav_name',
 169                                        array( ':tzid' => $tzid, ':dav_name' => $dav_resource->dav_name()) );
 170       }
 171       else {
 172         $failure['set-'.$tag] = new XMLElement( 'propstat', array(
 173             new XMLElement( 'prop', new XMLElement($tag)),
 174             new XMLElement( 'status', 'HTTP/1.1 403 Forbidden' ),
 175             new XMLElement( 'responsedescription', array(
 176                               new XMLElement( 'error', new XMLElement( 'cannot-modify-protected-property') ),
 177                               translate("calendar-timezone property is only valid for a calendar.") )
 178                           )
 179         ));
 180       }
 181       break;
 182
 183     /**
 184     * The following properties are read-only, so they will cause the request to fail
 185     */
 186     case 'http://calendarserver.org/ns/:getctag':
 187     case 'DAV::owner':
 188     case 'DAV::principal-collection-set':
 189     case 'urn:ietf:params:xml:ns:caldav:calendar-user-address-set':
 190     case 'urn:ietf:params:xml:ns:caldav:schedule-inbox-URL':
 191     case 'urn:ietf:params:xml:ns:caldav:schedule-outbox-URL':
 192     case 'DAV::getetag':
 193     case 'DAV::getcontentlength':
 194     case 'DAV::getcontenttype':
 195     case 'DAV::getlastmodified':
 196     case 'DAV::creationdate':
 197     case 'DAV::lockdiscovery':
 198     case 'DAV::supportedlock':
 199       $failure['set-'.$tag] = new XMLElement( 'propstat', array(
 200           new XMLElement( 'prop', new XMLElement($tag)),
 201           new XMLElement( 'status', 'HTTP/1.1 403 Forbidden' ),
 202           new XMLElement( 'responsedescription', array(
 203                                new XMLElement( 'error', new XMLElement( 'cannot-modify-protected-property') ),
 204                                translate("Property is read-only") )
 205                         )
 206       ));
 207       break;
 208
 209     /**
 210     * If we don't have any special processing for the property, we just store it verbatim (which will be an XML fragment).
 211     */
 212     default:
 213       $qry->QDo('SELECT set_dav_property( :dav_name, :user_no::integer, :tag::text, :value::text)',
 214             array( ':dav_name' => $dav_resource->dav_name(), ':user_no' => $request->user_no, ':tag' => $tag, ':value' => $content) );
 215       $success[$tag] = 1;
 216       break;
 217   }
 218 }
 219
 220
 221
 222 foreach( $rmprops AS $k => $setting ) {
 223   $tag = $setting->GetTag();
 224   $content = $setting->RenderContent();
 225
 226   switch( $tag ) {
 227
 228     case 'DAV::resourcetype':
 229       $failure['rm-'.$tag] = new XMLElement( 'propstat', array(
 230           new XMLElement( 'prop', new XMLElement($tag)),
 231             new XMLElement( 'status', 'HTTP/1.1 403 Forbidden' ),
 232             new XMLElement( 'responsedescription', array(
 233                               new XMLElement( 'error', new XMLElement( 'cannot-modify-protected-property') ),
 234                               translate("DAV::resourcetype may only be set to a new value, it may not be removed.") )
 235                           )
 236       ));
 237       break;
 238
 239     case 'urn:ietf:params:xml:ns:caldav:calendar-timezone':
 240       if ( $dav_resource->IsCollection() && $dav_resource->IsCalendar() && ! $dav_resource->IsBinding() ) {
 241         $qry->QDo('UPDATE collection SET timezone = NULL WHERE dav_name = :dav_name', array( ':dav_name' => $dav_resource->dav_name()) );
 242       }
 243       else {
 244         $failure['set-'.$tag] = new XMLElement( 'propstat', array(
 245             new XMLElement( 'prop', new XMLElement($tag)),
 246             new XMLElement( 'status', 'HTTP/1.1 403 Forbidden' ),
 247             new XMLElement( 'responsedescription', array(
 248                               new XMLElement( 'error', new XMLElement( 'cannot-modify-protected-property') ),
 249                               translate("calendar-timezone property is only valid for a calendar.") )
 250                           )
 251         ));
 252       }
 253       break;
 254
 255     /**
 256     * The following properties are read-only, so they will cause the request to fail
 257     */
 258     case 'http://calendarserver.org/ns/:getctag':
 259     case 'DAV::owner':
 260     case 'DAV::principal-collection-set':
 261     case 'urn:ietf:params:xml:ns:caldav:CALENDAR-USER-ADDRESS-SET':
 262     case 'urn:ietf:params:xml:ns:caldav:schedule-inbox-URL':
 263     case 'urn:ietf:params:xml:ns:caldav:schedule-outbox-URL':
 264     case 'DAV::getetag':
 265     case 'DAV::getcontentlength':
 266     case 'DAV::getcontenttype':
 267     case 'DAV::getlastmodified':
 268     case 'DAV::creationdate':
 269     case 'DAV::displayname':
 270     case 'DAV::lockdiscovery':
 271     case 'DAV::supportedlock':
 272       $failure['rm-'.$tag] = new XMLElement( 'propstat', array(
 273           new XMLElement( 'prop', new XMLElement($tag)),
 274           new XMLElement( 'status', 'HTTP/1.1 409 Conflict' ),
 275           new XMLElement('responsedescription', translate("Property is read-only") )
 276       ));
 277       dbg_error_log( 'PROPPATCH', ' RMProperty %s is read only and cannot be removed', $tag);
 278       break;
 279
 280     /**
 281     * If we don't have any special processing then we must have to just delete it.  Nonexistence is not failure.
 282     */
 283     default:
 284       $qry->QDo('DELETE FROM property WHERE dav_name=:dav_name AND property_name=:property_name',
 285                   array( ':dav_name' => $dav_resource->dav_name(), ':property_name' => $tag) );
 286       $success[$tag] = 1;
 287       break;
 288   }
 289 }
 290
 291
 292 /**
 293 * If we have encountered any instances of failure, the whole damn thing fails.
 294 */
 295 if ( count($failure) > 0 ) {
 296   foreach( $success AS $tag => $v ) {
 297     // Unfortunately although these succeeded, we failed overall, so they didn't happen...
 298     $failure[] = new XMLElement( 'propstat', array(
 299         new XMLElement( 'prop', new XMLElement($tag)),
 300         new XMLElement( 'status', 'HTTP/1.1 424 Failed Dependency' ),
 301     ));
 302   }
 303
 304   $url = ConstructURL($request->path);
 305   array_unshift( $failure, new XMLElement('href', $url ) );
 306   $failure[] = new XMLElement('responsedescription', translate("Some properties were not able to be changed.") );
 307
 308   $qry->Rollback();
 309
 310   $multistatus = new XMLElement( "multistatus", new XMLElement( 'response', $failure ), array('xmlns'=>'DAV:') );
 311   $request->DoResponse( 207, $multistatus->Render(0,'<?xml version="1.0" encoding="utf-8" ?>'), 'text/xml; charset="utf-8"' );
 312
 313 }
 314
 315 /**
 316 * Otherwise we will try and do the SQL. This is inside a transaction, so PostgreSQL guarantees the atomicity
 317 */
 318 ;
 319 if ( $qry->Commit() ) {
 320
 321   $cache = getCacheInstance();
 322   $cache_ns = null;
 323   if ( $dav_resource->IsPrincipal() ) {
 324     $cache_ns = 'principal-'.$dav_resource->dav_name();
 325   }
 326   else if ( $dav_resource->IsCollection() ) {
 327     // Uncache anything to do with the collection
 328     $cache_ns = 'collection-'.$dav_resource->dav_name();
 329   }
 330
 331   if ( isset($cache_ns) ) $cache->delete( $cache_ns, null );
 332
 333   $url = ConstructURL($request->path);
 334   $href = new XMLElement('href', $url );
 335   $desc = new XMLElement('responsedescription', translate("All requested changes were made.") );
 336
 337   $propstat = array();
 338   foreach( $success AS $tag => $v ) {
 339     $propstat[] = new XMLElement( 'propstat', array(
 340     new XMLElement( 'prop', new XMLElement($tag)),
 341     new XMLElement( 'status', 'HTTP/1.1 200 OK' ),
 342     ));
 343   }
 344
 345   $url = ConstructURL($request->path);
 346   array_unshift( $failure, new XMLElement('href', $url ) );
 347
 348   $multistatus = new XMLElement( "multistatus", new XMLElement( 'response', array( $href, $propstat, $desc ) ), array('xmlns'=>'DAV:') );
 349   $request->DoResponse( 200, $multistatus->Render(0,'<?xml version="1.0" encoding="utf-8" ?>'), 'text/xml; charset="utf-8"' );
 350 }
 351
 352 /**
 353 * Or it was all crap.
 354 */
 355 $request->DoResponse( 500 );
 356 exit(0); // unneccessary
 357