inc/caldav-POST.php

   1 <?php
   2 /**
   3 * CalDAV Server - handle PUT method
   4 *
   5 * @package   davical
   6 * @subpackage   caldav
   7 * @author    Andrew McMillan <andrew@morphoss.com>
   8 * @copyright Morphoss Ltd - http://www.morphoss.com/
   9 * @license   http://gnu.org/copyleft/gpl.html GNU GPL v2 or later
  10 */
  11 dbg_error_log("POST", "method handler");
  12
  13 require_once("XMLDocument.php");
  14 include_once('caldav-PUT-functions.php');
  15 include_once('freebusy-functions.php');
  16 include_once('iSchedule.php');
  17
  18 if ( ! $request->AllowedTo("CALDAV:schedule-send-freebusy")
  19   && ! $request->AllowedTo("CALDAV:schedule-send-invite")
  20   && ! $request->AllowedTo("CALDAV:schedule-send-reply") ) {
  21   // $request->DoResponse(403);
  22   dbg_error_log( "WARN", ": POST: permissions not yet checked" );
  23 }
  24
  25 if ( ! ini_get('open_basedir') && (isset($c->dbg['ALL']) || isset($c->dbg['post'])) ) {
  26   $fh = fopen('/tmp/POST.txt','w');
  27   if ( $fh ) {
  28     fwrite($fh,$request->raw_post);
  29     fclose($fh);
  30   }
  31 }
  32
  33
  34 function handle_freebusy_request( $ic ) {
  35   global $c, $session, $request, $ical;
  36
  37   $reply = new XMLDocument( array("DAV:" => "", "urn:ietf:params:xml:ns:caldav" => "C" ) );
  38   $responses = array();
  39
  40   $fbq_start = $ic->GetPValue('DTSTART');
  41   $fbq_end   = $ic->GetPValue('DTEND');
  42   if ( ! ( isset($fbq_start) || isset($fbq_end) ) ) {
  43     $request->DoResponse( 400, 'All valid freebusy requests MUST contain a DTSTART and a DTEND' );
  44   }
  45
  46   $range_start = new RepeatRuleDateTime($fbq_start);
  47   $range_end   = new RepeatRuleDateTime($fbq_end);
  48
  49   $attendees = $ic->GetProperties('ATTENDEE');
  50   if ( preg_match( '# iCal/\d#', $_SERVER['HTTP_USER_AGENT']) ) {
  51     dbg_error_log( "POST", "Non-compliant iCal request.  Using X-WR-ATTENDEE property" );
  52     $wr_attendees = $ic->GetProperties('X-WR-ATTENDEE');
  53     foreach( $wr_attendees AS $k => $v ) {
  54       $attendees[] = $v;
  55     }
  56   }
  57   dbg_error_log( "POST", "Responding with free/busy for %d attendees", count($attendees) );
  58
  59   foreach( $attendees AS $k => $attendee ) {
  60     $attendee_email = preg_replace( '/^mailto:/', '', $attendee->Value() );
  61     dbg_error_log( "POST", "Calculating free/busy for %s", $attendee_email );
  62
  63     /** @todo Refactor this so we only do one query here and loop through the results */
  64     $params = array( ':session_principal' => $session->principal_id, ':scan_depth' => $c->permission_scan_depth, ':email' => $attendee_email );
  65     $qry = new AwlQuery('SELECT pprivs(:session_principal::int8,principal_id,:scan_depth::int) AS p, username FROM usr JOIN principal USING(user_no) WHERE lower(usr.email) = lower(:email)', $params );
  66     if ( !$qry->Exec('POST',__LINE__,__FILE__) ) $request->DoResponse( 501, 'Database error');
  67     if ( $qry->rows() > 1 ) {
  68       // Unlikely, but if we get more than one result we'll do an exact match instead.
  69       if ( !$qry->QDo('SELECT pprivs(:session_principal::int8,principal_id,:scan_depth::int) AS p, username FROM usr JOIN principal USING(user_no) WHERE usr.email = :email', $params ) )
  70         $request->DoResponse( 501, 'Database error');
  71       if ( $qry->rows() == 0 ) {
  72         /** Sigh... Go back to the original case-insensitive match */
  73         $qry->QDo('SELECT pprivs(:session_principal::int8,principal_id,:scan_depth::int) AS p, username FROM usr JOIN principal USING(user_no) WHERE lower(usr.email) = lower(:email)', $params );
  74       }
  75     }
  76
  77     $response = $reply->NewXMLElement("response", false, false, 'urn:ietf:params:xml:ns:caldav');
  78     $reply->CalDAVElement($response, "recipient", $reply->href($attendee->Value()) );
  79
  80     if ( $qry->rows() == 0 ) {
  81       $remote = new iSchedule ();
  82       $answer = $remote->sendRequest ( $attendee->Value(), 'VFREEBUSY/REQUEST', $ical->Render() );
  83       if ( $answer === false ) {
  84         $reply->CalDAVElement($response, "request-status", "3.7;Invalid Calendar User" );
  85         $reply->CalDAVElement($response, "calendar-data" );
  86         continue;
  87       }
  88       foreach ( $answer as $a )
  89       {
  90         if ( $a === false ) {
  91           $reply->CalDAVElement($response, "request-status", "3.7;Invalid Calendar User" );
  92           $reply->CalDAVElement($response, "calendar-data" );
  93         }
  94         elseif ( substr( $a, 0, 1 ) >= 1 ) {
  95           $reply->CalDAVElement($response, "request-status", $a );
  96           $reply->CalDAVElement($response, "calendar-data" );
  97         }
  98         else {
  99           $reply->CalDAVElement($response, "request-status", "2.0;Success" );
 100           $reply->CalDAVElement($response, "calendar-data", $a );
 101         }
 102         $responses[] = $response;
 103       }
 104       continue;
 105     }
 106     if ( ! $attendee_usr = $qry->Fetch() ) $request->DoResponse( 501, 'Database error');
 107     if ( (privilege_to_bits('schedule-query-freebusy') & bindec($attendee_usr->p)) == 0 ) {
 108       $reply->CalDAVElement($response, "request-status", "3.8;No authority" );
 109       $reply->CalDAVElement($response, "calendar-data" );
 110       $responses[] = $response;
 111       continue;
 112     }
 113     $attendee_path_match = '^/'.$attendee_usr->username.'/';
 114     $fb = get_freebusy( $attendee_path_match, $range_start, $range_end, bindec($attendee_usr->p) );
 115
 116     $fb->AddProperty( 'UID',       $ic->GetPValue('UID') );
 117     $fb->SetProperties( $ic->GetProperties('ORGANIZER'), 'ORGANIZER');
 118     $fb->AddProperty( $attendee );
 119
 120     $vcal = new vCalendar( array('METHOD' => 'REPLY') );
 121     $vcal->AddComponent( $fb );
 122
 123     $response = $reply->NewXMLElement( "response", false, false, 'urn:ietf:params:xml:ns:caldav' );
 124     $reply->CalDAVElement($response, "recipient", $reply->href($attendee->Value()) );
 125     $reply->CalDAVElement($response, "request-status", "2.0;Success" );  // Cargo-cult setting
 126     $reply->CalDAVElement($response, "calendar-data", $vcal->Render() );
 127     $responses[] = $response;
 128   }
 129
 130   $response = $reply->NewXMLElement( "schedule-response", $responses, $reply->GetXmlNsArray(), 'urn:ietf:params:xml:ns:caldav' );
 131   $request->XMLResponse( 200, $response );
 132 }
 133
 134
 135 function handle_cancel_request( $ic ) {
 136   global $c, $session, $request;
 137
 138   $reply = new XMLDocument( array("DAV:" => "", "urn:ietf:params:xml:ns:caldav" => "C" ) );
 139
 140   $response = $reply->NewXMLElement( "response", false, false, 'urn:ietf:params:xml:ns:caldav' );
 141   $reply->CalDAVElement($response, "request-status", "2.0;Success" );  // Cargo-cult setting
 142   $response = $reply->NewXMLElement( "schedule-response", $response, $reply->GetXmlNsArray() );
 143   $request->XMLResponse( 200, $response );
 144 }
 145
 146 $ical = new vCalendar( $request->raw_post );
 147 $method =  $ical->GetPValue('METHOD');
 148
 149 $resources = $ical->GetComponents('VTIMEZONE',false);
 150 $first = $resources[0];
 151 switch ( $method ) {
 152   case 'REQUEST':
 153     dbg_error_log('POST', 'Handling iTIP "REQUEST" method with "%s" component.', $method, $first->GetType() );
 154     if ( $first->GetType() == 'VFREEBUSY' )
 155       handle_freebusy_request( $first );
 156     elseif ( $first->GetType() == 'VEVENT' ) {
 157       handle_schedule_request( $ical );
 158     }
 159     else {
 160       dbg_error_log('POST', 'Ignoring iTIP "REQUEST" with "%s" component.', $first->GetType() );
 161     }
 162     break;
 163   case 'REPLY':
 164     dbg_error_log('POST', 'Handling iTIP "REPLY" with "%s" component.', $first->GetType() );
 165     handle_schedule_reply ( $ical );
 166     break;
 167
 168   case 'CANCEL':
 169     dbg_error_log("POST", "Handling iTIP 'CANCEL'  method.", $method );
 170     handle_cancel_request( $first );
 171     break;
 172
 173   default:
 174     dbg_error_log("POST", "Unhandled '%s' method in request.", $method );
 175 }