CustomPropertiesBackend.php 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. * @copyright Copyright (c) 2017, Georg Ehrke <oc.list@georgehrke.com>
  5. *
  6. * @author Georg Ehrke <oc.list@georgehrke.com>
  7. * @author Robin Appelman <robin@icewind.nl>
  8. * @author Thomas Müller <thomas.mueller@tmit.eu>
  9. * @author Richard Steinmetz <richard@steinmetz.cloud>
  10. *
  11. * @license AGPL-3.0
  12. *
  13. * This code is free software: you can redistribute it and/or modify
  14. * it under the terms of the GNU Affero General Public License, version 3,
  15. * as published by the Free Software Foundation.
  16. *
  17. * This program is distributed in the hope that it will be useful,
  18. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. * GNU Affero General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU Affero General Public License, version 3,
  23. * along with this program. If not, see <http://www.gnu.org/licenses/>
  24. *
  25. */
  26. namespace OCA\DAV\DAV;
  27. use Exception;
  28. use OCA\DAV\Connector\Sabre\Directory;
  29. use OCA\DAV\Connector\Sabre\FilesPlugin;
  30. use OCP\DB\QueryBuilder\IQueryBuilder;
  31. use OCP\IDBConnection;
  32. use OCP\IUser;
  33. use Sabre\CalDAV\ICalendar;
  34. use Sabre\DAV\Exception as DavException;
  35. use Sabre\DAV\PropertyStorage\Backend\BackendInterface;
  36. use Sabre\DAV\PropFind;
  37. use Sabre\DAV\PropPatch;
  38. use Sabre\DAV\Server;
  39. use Sabre\DAV\Tree;
  40. use Sabre\DAV\Xml\Property\Complex;
  41. use Sabre\DAV\Xml\Property\Href;
  42. use Sabre\DAV\Xml\Property\LocalHref;
  43. use Sabre\Xml\ParseException;
  44. use Sabre\Xml\Service as XmlService;
  45. use function array_intersect;
  46. class CustomPropertiesBackend implements BackendInterface {
  47. /** @var string */
  48. private const TABLE_NAME = 'properties';
  49. /**
  50. * Value is stored as string.
  51. */
  52. public const PROPERTY_TYPE_STRING = 1;
  53. /**
  54. * Value is stored as XML fragment.
  55. */
  56. public const PROPERTY_TYPE_XML = 2;
  57. /**
  58. * Value is stored as a property object.
  59. */
  60. public const PROPERTY_TYPE_OBJECT = 3;
  61. /**
  62. * Value is stored as a {DAV:}href string.
  63. */
  64. public const PROPERTY_TYPE_HREF = 4;
  65. /**
  66. * Ignored properties
  67. *
  68. * @var string[]
  69. */
  70. private const IGNORED_PROPERTIES = [
  71. '{DAV:}getcontentlength',
  72. '{DAV:}getcontenttype',
  73. '{DAV:}getetag',
  74. '{DAV:}quota-used-bytes',
  75. '{DAV:}quota-available-bytes',
  76. '{http://owncloud.org/ns}permissions',
  77. '{http://owncloud.org/ns}downloadURL',
  78. '{http://owncloud.org/ns}dDC',
  79. '{http://owncloud.org/ns}size',
  80. '{http://nextcloud.org/ns}is-encrypted',
  81. // Currently, returning null from any propfind handler would still trigger the backend,
  82. // so we add all known Nextcloud custom properties in here to avoid that
  83. // text app
  84. '{http://nextcloud.org/ns}rich-workspace',
  85. '{http://nextcloud.org/ns}rich-workspace-file',
  86. // groupfolders
  87. '{http://nextcloud.org/ns}acl-enabled',
  88. '{http://nextcloud.org/ns}acl-can-manage',
  89. '{http://nextcloud.org/ns}acl-list',
  90. '{http://nextcloud.org/ns}inherited-acl-list',
  91. '{http://nextcloud.org/ns}group-folder-id',
  92. // files_lock
  93. '{http://nextcloud.org/ns}lock',
  94. '{http://nextcloud.org/ns}lock-owner-type',
  95. '{http://nextcloud.org/ns}lock-owner',
  96. '{http://nextcloud.org/ns}lock-owner-displayname',
  97. '{http://nextcloud.org/ns}lock-owner-editor',
  98. '{http://nextcloud.org/ns}lock-time',
  99. '{http://nextcloud.org/ns}lock-timeout',
  100. '{http://nextcloud.org/ns}lock-token',
  101. ];
  102. /**
  103. * Properties set by one user, readable by all others
  104. *
  105. * @var string[]
  106. */
  107. private const PUBLISHED_READ_ONLY_PROPERTIES = [
  108. '{urn:ietf:params:xml:ns:caldav}calendar-availability',
  109. '{urn:ietf:params:xml:ns:caldav}schedule-default-calendar-URL',
  110. ];
  111. /**
  112. * Map of custom XML elements to parse when trying to deserialize an instance of
  113. * \Sabre\DAV\Xml\Property\Complex to find a more specialized PROPERTY_TYPE_*
  114. */
  115. private const COMPLEX_XML_ELEMENT_MAP = [
  116. '{urn:ietf:params:xml:ns:caldav}schedule-default-calendar-URL' => Href::class,
  117. ];
  118. /**
  119. * @var Tree
  120. */
  121. private $tree;
  122. /**
  123. * @var IDBConnection
  124. */
  125. private $connection;
  126. /**
  127. * @var IUser
  128. */
  129. private $user;
  130. /**
  131. * Properties cache
  132. *
  133. * @var array
  134. */
  135. private $userCache = [];
  136. private Server $server;
  137. private XmlService $xmlService;
  138. /**
  139. * @param Tree $tree node tree
  140. * @param IDBConnection $connection database connection
  141. * @param IUser $user owner of the tree and properties
  142. */
  143. public function __construct(
  144. Server $server,
  145. Tree $tree,
  146. IDBConnection $connection,
  147. IUser $user,
  148. ) {
  149. $this->server = $server;
  150. $this->tree = $tree;
  151. $this->connection = $connection;
  152. $this->user = $user;
  153. $this->xmlService = new XmlService();
  154. $this->xmlService->elementMap = array_merge(
  155. $this->xmlService->elementMap,
  156. self::COMPLEX_XML_ELEMENT_MAP,
  157. );
  158. }
  159. /**
  160. * Fetches properties for a path.
  161. *
  162. * @param string $path
  163. * @param PropFind $propFind
  164. * @return void
  165. */
  166. public function propFind($path, PropFind $propFind) {
  167. $requestedProps = $propFind->get404Properties();
  168. // these might appear
  169. $requestedProps = array_diff(
  170. $requestedProps,
  171. self::IGNORED_PROPERTIES,
  172. );
  173. $requestedProps = array_filter(
  174. $requestedProps,
  175. fn ($prop) => !str_starts_with($prop, FilesPlugin::FILE_METADATA_PREFIX),
  176. );
  177. // substr of calendars/ => path is inside the CalDAV component
  178. // two '/' => this a calendar (no calendar-home nor calendar object)
  179. if (str_starts_with($path, 'calendars/') && substr_count($path, '/') === 2) {
  180. $allRequestedProps = $propFind->getRequestedProperties();
  181. $customPropertiesForShares = [
  182. '{DAV:}displayname',
  183. '{urn:ietf:params:xml:ns:caldav}calendar-description',
  184. '{urn:ietf:params:xml:ns:caldav}calendar-timezone',
  185. '{http://apple.com/ns/ical/}calendar-order',
  186. '{http://apple.com/ns/ical/}calendar-color',
  187. '{urn:ietf:params:xml:ns:caldav}schedule-calendar-transp',
  188. ];
  189. foreach ($customPropertiesForShares as $customPropertyForShares) {
  190. if (in_array($customPropertyForShares, $allRequestedProps)) {
  191. $requestedProps[] = $customPropertyForShares;
  192. }
  193. }
  194. }
  195. // substr of addressbooks/ => path is inside the CardDAV component
  196. // three '/' => this a addressbook (no addressbook-home nor contact object)
  197. if (str_starts_with($path, 'addressbooks/') && substr_count($path, '/') === 3) {
  198. $allRequestedProps = $propFind->getRequestedProperties();
  199. $customPropertiesForShares = [
  200. '{DAV:}displayname',
  201. ];
  202. foreach ($customPropertiesForShares as $customPropertyForShares) {
  203. if (in_array($customPropertyForShares, $allRequestedProps, true)) {
  204. $requestedProps[] = $customPropertyForShares;
  205. }
  206. }
  207. }
  208. // substr of principals/users/ => path is a user principal
  209. // two '/' => this a principal collection (and not some child object)
  210. if (str_starts_with($path, 'principals/users/') && substr_count($path, '/') === 2) {
  211. $allRequestedProps = $propFind->getRequestedProperties();
  212. $customProperties = [
  213. '{urn:ietf:params:xml:ns:caldav}schedule-default-calendar-URL',
  214. ];
  215. foreach ($customProperties as $customProperty) {
  216. if (in_array($customProperty, $allRequestedProps, true)) {
  217. $requestedProps[] = $customProperty;
  218. }
  219. }
  220. }
  221. if (empty($requestedProps)) {
  222. return;
  223. }
  224. $node = $this->tree->getNodeForPath($path);
  225. if ($node instanceof Directory && $propFind->getDepth() !== 0) {
  226. $this->cacheDirectory($path, $node);
  227. }
  228. // First fetch the published properties (set by another user), then get the ones set by
  229. // the current user. If both are set then the latter as priority.
  230. foreach ($this->getPublishedProperties($path, $requestedProps) as $propName => $propValue) {
  231. try {
  232. $this->validateProperty($path, $propName, $propValue);
  233. } catch (DavException $e) {
  234. continue;
  235. }
  236. $propFind->set($propName, $propValue);
  237. }
  238. foreach ($this->getUserProperties($path, $requestedProps) as $propName => $propValue) {
  239. try {
  240. $this->validateProperty($path, $propName, $propValue);
  241. } catch (DavException $e) {
  242. continue;
  243. }
  244. $propFind->set($propName, $propValue);
  245. }
  246. }
  247. /**
  248. * Updates properties for a path
  249. *
  250. * @param string $path
  251. * @param PropPatch $propPatch
  252. *
  253. * @return void
  254. */
  255. public function propPatch($path, PropPatch $propPatch) {
  256. $propPatch->handleRemaining(function ($changedProps) use ($path) {
  257. return $this->updateProperties($path, $changedProps);
  258. });
  259. }
  260. /**
  261. * This method is called after a node is deleted.
  262. *
  263. * @param string $path path of node for which to delete properties
  264. */
  265. public function delete($path) {
  266. $statement = $this->connection->prepare(
  267. 'DELETE FROM `*PREFIX*properties` WHERE `userid` = ? AND `propertypath` = ?'
  268. );
  269. $statement->execute([$this->user->getUID(), $this->formatPath($path)]);
  270. $statement->closeCursor();
  271. unset($this->userCache[$path]);
  272. }
  273. /**
  274. * This method is called after a successful MOVE
  275. *
  276. * @param string $source
  277. * @param string $destination
  278. *
  279. * @return void
  280. */
  281. public function move($source, $destination) {
  282. $statement = $this->connection->prepare(
  283. 'UPDATE `*PREFIX*properties` SET `propertypath` = ?' .
  284. ' WHERE `userid` = ? AND `propertypath` = ?'
  285. );
  286. $statement->execute([$this->formatPath($destination), $this->user->getUID(), $this->formatPath($source)]);
  287. $statement->closeCursor();
  288. }
  289. /**
  290. * Validate the value of a property. Will throw if a value is invalid.
  291. *
  292. * @throws DavException The value of the property is invalid
  293. */
  294. private function validateProperty(string $path, string $propName, mixed $propValue): void {
  295. switch ($propName) {
  296. case '{urn:ietf:params:xml:ns:caldav}schedule-default-calendar-URL':
  297. /** @var Href $propValue */
  298. $href = $propValue->getHref();
  299. if ($href === null) {
  300. throw new DavException('Href is empty');
  301. }
  302. // $path is the principal here as this prop is only set on principals
  303. $node = $this->tree->getNodeForPath($href);
  304. if (!($node instanceof ICalendar) || $node->getOwner() !== $path) {
  305. throw new DavException('No such calendar');
  306. }
  307. break;
  308. }
  309. }
  310. /**
  311. * @param string $path
  312. * @param string[] $requestedProperties
  313. *
  314. * @return array
  315. */
  316. private function getPublishedProperties(string $path, array $requestedProperties): array {
  317. $allowedProps = array_intersect(self::PUBLISHED_READ_ONLY_PROPERTIES, $requestedProperties);
  318. if (empty($allowedProps)) {
  319. return [];
  320. }
  321. $qb = $this->connection->getQueryBuilder();
  322. $qb->select('*')
  323. ->from(self::TABLE_NAME)
  324. ->where($qb->expr()->eq('propertypath', $qb->createNamedParameter($path)));
  325. $result = $qb->executeQuery();
  326. $props = [];
  327. while ($row = $result->fetch()) {
  328. $props[$row['propertyname']] = $this->decodeValueFromDatabase($row['propertyvalue'], $row['valuetype']);
  329. }
  330. $result->closeCursor();
  331. return $props;
  332. }
  333. /**
  334. * prefetch all user properties in a directory
  335. */
  336. private function cacheDirectory(string $path, Directory $node): void {
  337. $prefix = ltrim($path . '/', '/');
  338. $query = $this->connection->getQueryBuilder();
  339. $query->select('name', 'propertypath', 'propertyname', 'propertyvalue', 'valuetype')
  340. ->from('filecache', 'f')
  341. ->leftJoin('f', 'properties', 'p', $query->expr()->andX(
  342. $query->expr()->eq('propertypath', $query->func()->concat(
  343. $query->createNamedParameter($prefix),
  344. 'name'
  345. )),
  346. $query->expr()->eq('userid', $query->createNamedParameter($this->user->getUID()))
  347. ))
  348. ->where($query->expr()->eq('parent', $query->createNamedParameter($node->getInternalFileId(), IQueryBuilder::PARAM_INT)));
  349. $result = $query->executeQuery();
  350. $propsByPath = [];
  351. while ($row = $result->fetch()) {
  352. $childPath = $prefix . $row['name'];
  353. if (!isset($propsByPath[$childPath])) {
  354. $propsByPath[$childPath] = [];
  355. }
  356. if (isset($row['propertyname'])) {
  357. $propsByPath[$childPath][$row['propertyname']] = $this->decodeValueFromDatabase($row['propertyvalue'], $row['valuetype']);
  358. }
  359. }
  360. $this->userCache = array_merge($this->userCache, $propsByPath);
  361. }
  362. /**
  363. * Returns a list of properties for the given path and current user
  364. *
  365. * @param string $path
  366. * @param array $requestedProperties requested properties or empty array for "all"
  367. * @return array
  368. * @note The properties list is a list of propertynames the client
  369. * requested, encoded as xmlnamespace#tagName, for example:
  370. * http://www.example.org/namespace#author If the array is empty, all
  371. * properties should be returned
  372. */
  373. private function getUserProperties(string $path, array $requestedProperties) {
  374. if (isset($this->userCache[$path])) {
  375. return $this->userCache[$path];
  376. }
  377. // TODO: chunking if more than 1000 properties
  378. $sql = 'SELECT * FROM `*PREFIX*properties` WHERE `userid` = ? AND `propertypath` = ?';
  379. $whereValues = [$this->user->getUID(), $this->formatPath($path)];
  380. $whereTypes = [null, null];
  381. if (!empty($requestedProperties)) {
  382. // request only a subset
  383. $sql .= ' AND `propertyname` in (?)';
  384. $whereValues[] = $requestedProperties;
  385. $whereTypes[] = \Doctrine\DBAL\Connection::PARAM_STR_ARRAY;
  386. }
  387. $result = $this->connection->executeQuery(
  388. $sql,
  389. $whereValues,
  390. $whereTypes
  391. );
  392. $props = [];
  393. while ($row = $result->fetch()) {
  394. $props[$row['propertyname']] = $this->decodeValueFromDatabase($row['propertyvalue'], $row['valuetype']);
  395. }
  396. $result->closeCursor();
  397. $this->userCache[$path] = $props;
  398. return $props;
  399. }
  400. /**
  401. * @throws Exception
  402. */
  403. private function updateProperties(string $path, array $properties): bool {
  404. // TODO: use "insert or update" strategy ?
  405. $existing = $this->getUserProperties($path, []);
  406. try {
  407. $this->connection->beginTransaction();
  408. foreach ($properties as $propertyName => $propertyValue) {
  409. // common parameters for all queries
  410. $dbParameters = [
  411. 'userid' => $this->user->getUID(),
  412. 'propertyPath' => $this->formatPath($path),
  413. 'propertyName' => $propertyName,
  414. ];
  415. // If it was null, we need to delete the property
  416. if (is_null($propertyValue)) {
  417. if (array_key_exists($propertyName, $existing)) {
  418. $deleteQuery = $deleteQuery ?? $this->createDeleteQuery();
  419. $deleteQuery
  420. ->setParameters($dbParameters)
  421. ->executeStatement();
  422. }
  423. } else {
  424. [$value, $valueType] = $this->encodeValueForDatabase(
  425. $path,
  426. $propertyName,
  427. $propertyValue,
  428. );
  429. $dbParameters['propertyValue'] = $value;
  430. $dbParameters['valueType'] = $valueType;
  431. if (!array_key_exists($propertyName, $existing)) {
  432. $insertQuery = $insertQuery ?? $this->createInsertQuery();
  433. $insertQuery
  434. ->setParameters($dbParameters)
  435. ->executeStatement();
  436. } else {
  437. $updateQuery = $updateQuery ?? $this->createUpdateQuery();
  438. $updateQuery
  439. ->setParameters($dbParameters)
  440. ->executeStatement();
  441. }
  442. }
  443. }
  444. $this->connection->commit();
  445. unset($this->userCache[$path]);
  446. } catch (Exception $e) {
  447. $this->connection->rollBack();
  448. throw $e;
  449. }
  450. return true;
  451. }
  452. /**
  453. * long paths are hashed to ensure they fit in the database
  454. *
  455. * @param string $path
  456. * @return string
  457. */
  458. private function formatPath(string $path): string {
  459. if (strlen($path) > 250) {
  460. return sha1($path);
  461. }
  462. return $path;
  463. }
  464. /**
  465. * @throws ParseException If parsing a \Sabre\DAV\Xml\Property\Complex value fails
  466. * @throws DavException If the property value is invalid
  467. */
  468. private function encodeValueForDatabase(string $path, string $name, mixed $value): array {
  469. // Try to parse a more specialized property type first
  470. if ($value instanceof Complex) {
  471. $xml = $this->xmlService->write($name, [$value], $this->server->getBaseUri());
  472. $value = $this->xmlService->parse($xml, $this->server->getBaseUri()) ?? $value;
  473. }
  474. if ($name === '{urn:ietf:params:xml:ns:caldav}schedule-default-calendar-URL') {
  475. $value = $this->encodeDefaultCalendarUrl($value);
  476. }
  477. try {
  478. $this->validateProperty($path, $name, $value);
  479. } catch (DavException $e) {
  480. throw new DavException(
  481. "Property \"$name\" has an invalid value: " . $e->getMessage(),
  482. 0,
  483. $e,
  484. );
  485. }
  486. if (is_scalar($value)) {
  487. $valueType = self::PROPERTY_TYPE_STRING;
  488. } elseif ($value instanceof Complex) {
  489. $valueType = self::PROPERTY_TYPE_XML;
  490. $value = $value->getXml();
  491. } elseif ($value instanceof Href) {
  492. $valueType = self::PROPERTY_TYPE_HREF;
  493. $value = $value->getHref();
  494. } else {
  495. $valueType = self::PROPERTY_TYPE_OBJECT;
  496. $value = serialize($value);
  497. }
  498. return [$value, $valueType];
  499. }
  500. /**
  501. * @return mixed|Complex|string
  502. */
  503. private function decodeValueFromDatabase(string $value, int $valueType) {
  504. switch ($valueType) {
  505. case self::PROPERTY_TYPE_XML:
  506. return new Complex($value);
  507. case self::PROPERTY_TYPE_HREF:
  508. return new Href($value);
  509. case self::PROPERTY_TYPE_OBJECT:
  510. return unserialize($value);
  511. case self::PROPERTY_TYPE_STRING:
  512. default:
  513. return $value;
  514. }
  515. }
  516. private function encodeDefaultCalendarUrl(Href $value): Href {
  517. $href = $value->getHref();
  518. if ($href === null) {
  519. return $value;
  520. }
  521. if (!str_starts_with($href, '/')) {
  522. return $value;
  523. }
  524. try {
  525. // Build path relative to the dav base URI to be used later to find the node
  526. $value = new LocalHref($this->server->calculateUri($href) . '/');
  527. } catch (DavException\Forbidden) {
  528. // Not existing calendars will be handled later when the value is validated
  529. }
  530. return $value;
  531. }
  532. private function createDeleteQuery(): IQueryBuilder {
  533. $deleteQuery = $this->connection->getQueryBuilder();
  534. $deleteQuery->delete('properties')
  535. ->where($deleteQuery->expr()->eq('userid', $deleteQuery->createParameter('userid')))
  536. ->andWhere($deleteQuery->expr()->eq('propertypath', $deleteQuery->createParameter('propertyPath')))
  537. ->andWhere($deleteQuery->expr()->eq('propertyname', $deleteQuery->createParameter('propertyName')));
  538. return $deleteQuery;
  539. }
  540. private function createInsertQuery(): IQueryBuilder {
  541. $insertQuery = $this->connection->getQueryBuilder();
  542. $insertQuery->insert('properties')
  543. ->values([
  544. 'userid' => $insertQuery->createParameter('userid'),
  545. 'propertypath' => $insertQuery->createParameter('propertyPath'),
  546. 'propertyname' => $insertQuery->createParameter('propertyName'),
  547. 'propertyvalue' => $insertQuery->createParameter('propertyValue'),
  548. 'valuetype' => $insertQuery->createParameter('valueType'),
  549. ]);
  550. return $insertQuery;
  551. }
  552. private function createUpdateQuery(): IQueryBuilder {
  553. $updateQuery = $this->connection->getQueryBuilder();
  554. $updateQuery->update('properties')
  555. ->set('propertyvalue', $updateQuery->createParameter('propertyValue'))
  556. ->set('valuetype', $updateQuery->createParameter('valueType'))
  557. ->where($updateQuery->expr()->eq('userid', $updateQuery->createParameter('userid')))
  558. ->andWhere($updateQuery->expr()->eq('propertypath', $updateQuery->createParameter('propertyPath')))
  559. ->andWhere($updateQuery->expr()->eq('propertyname', $updateQuery->createParameter('propertyName')));
  560. return $updateQuery;
  561. }
  562. }