Plugin.php 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. *
  5. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  6. * @author Georg Ehrke <oc.list@georgehrke.com>
  7. * @author Morris Jobke <hey@morrisjobke.de>
  8. * @author Thomas Müller <thomas.mueller@tmit.eu>
  9. *
  10. * @license AGPL-3.0
  11. *
  12. * This code is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License, version 3,
  14. * as published by the Free Software Foundation.
  15. *
  16. * This program is distributed in the hope that it will be useful,
  17. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  19. * GNU Affero General Public License for more details.
  20. *
  21. * You should have received a copy of the GNU Affero General Public License, version 3,
  22. * along with this program. If not, see <http://www.gnu.org/licenses/>
  23. *
  24. */
  25. namespace OCA\DAV\DAV\Sharing;
  26. use OCA\DAV\CalDAV\CalDavBackend;
  27. use OCA\DAV\CalDAV\CalendarHome;
  28. use OCA\DAV\Connector\Sabre\Auth;
  29. use OCA\DAV\DAV\Sharing\Xml\Invite;
  30. use OCA\DAV\DAV\Sharing\Xml\ShareRequest;
  31. use OCP\IConfig;
  32. use OCP\IRequest;
  33. use Sabre\DAV\Exception\NotFound;
  34. use Sabre\DAV\INode;
  35. use Sabre\DAV\PropFind;
  36. use Sabre\DAV\Server;
  37. use Sabre\DAV\ServerPlugin;
  38. use Sabre\HTTP\RequestInterface;
  39. use Sabre\HTTP\ResponseInterface;
  40. class Plugin extends ServerPlugin {
  41. public const NS_OWNCLOUD = 'http://owncloud.org/ns';
  42. public const NS_NEXTCLOUD = 'http://nextcloud.com/ns';
  43. /** @var Auth */
  44. private $auth;
  45. /** @var IRequest */
  46. private $request;
  47. /** @var IConfig */
  48. private $config;
  49. /**
  50. * Plugin constructor.
  51. *
  52. * @param Auth $authBackEnd
  53. * @param IRequest $request
  54. * @param IConfig $config
  55. */
  56. public function __construct(Auth $authBackEnd, IRequest $request, IConfig $config) {
  57. $this->auth = $authBackEnd;
  58. $this->request = $request;
  59. $this->config = $config;
  60. }
  61. /**
  62. * Reference to SabreDAV server object.
  63. *
  64. * @var \Sabre\DAV\Server
  65. */
  66. protected $server;
  67. /**
  68. * This method should return a list of server-features.
  69. *
  70. * This is for example 'versioning' and is added to the DAV: header
  71. * in an OPTIONS response.
  72. *
  73. * @return string[]
  74. */
  75. public function getFeatures() {
  76. return ['oc-resource-sharing'];
  77. }
  78. /**
  79. * Returns a plugin name.
  80. *
  81. * Using this name other plugins will be able to access other plugins
  82. * using Sabre\DAV\Server::getPlugin
  83. *
  84. * @return string
  85. */
  86. public function getPluginName() {
  87. return 'oc-resource-sharing';
  88. }
  89. /**
  90. * This initializes the plugin.
  91. *
  92. * This function is called by Sabre\DAV\Server, after
  93. * addPlugin is called.
  94. *
  95. * This method should set up the required event subscriptions.
  96. *
  97. * @param Server $server
  98. * @return void
  99. */
  100. public function initialize(Server $server) {
  101. $this->server = $server;
  102. $this->server->xml->elementMap['{' . Plugin::NS_OWNCLOUD . '}share'] = ShareRequest::class;
  103. $this->server->xml->elementMap['{' . Plugin::NS_OWNCLOUD . '}invite'] = Invite::class;
  104. $this->server->on('method:POST', [$this, 'httpPost']);
  105. $this->server->on('propFind', [$this, 'propFind']);
  106. }
  107. /**
  108. * We intercept this to handle POST requests on a dav resource.
  109. *
  110. * @param RequestInterface $request
  111. * @param ResponseInterface $response
  112. * @return null|false
  113. */
  114. public function httpPost(RequestInterface $request, ResponseInterface $response) {
  115. $path = $request->getPath();
  116. // Only handling xml
  117. $contentType = (string) $request->getHeader('Content-Type');
  118. if (!str_contains($contentType, 'application/xml') && !str_contains($contentType, 'text/xml')) {
  119. return;
  120. }
  121. // Making sure the node exists
  122. try {
  123. $node = $this->server->tree->getNodeForPath($path);
  124. } catch (NotFound $e) {
  125. return;
  126. }
  127. $requestBody = $request->getBodyAsString();
  128. // If this request handler could not deal with this POST request, it
  129. // will return 'null' and other plugins get a chance to handle the
  130. // request.
  131. //
  132. // However, we already requested the full body. This is a problem,
  133. // because a body can only be read once. This is why we preemptively
  134. // re-populated the request body with the existing data.
  135. $request->setBody($requestBody);
  136. $message = $this->server->xml->parse($requestBody, $request->getUrl(), $documentType);
  137. switch ($documentType) {
  138. // Dealing with the 'share' document, which modified invitees on a
  139. // calendar.
  140. case '{' . self::NS_OWNCLOUD . '}share':
  141. // We can only deal with IShareableCalendar objects
  142. if (!$node instanceof IShareable) {
  143. return;
  144. }
  145. $this->server->transactionType = 'post-oc-resource-share';
  146. // Getting ACL info
  147. $acl = $this->server->getPlugin('acl');
  148. // If there's no ACL support, we allow everything
  149. if ($acl) {
  150. /** @var \Sabre\DAVACL\Plugin $acl */
  151. $acl->checkPrivileges($path, '{DAV:}write');
  152. $limitSharingToOwner = $this->config->getAppValue('dav', 'limitAddressBookAndCalendarSharingToOwner', 'no') === 'yes';
  153. $isOwner = $acl->getCurrentUserPrincipal() === $node->getOwner();
  154. if ($limitSharingToOwner && !$isOwner) {
  155. return;
  156. }
  157. }
  158. $node->updateShares($message->set, $message->remove);
  159. $response->setStatus(200);
  160. // Adding this because sending a response body may cause issues,
  161. // and I wanted some type of indicator the response was handled.
  162. $response->setHeader('X-Sabre-Status', 'everything-went-well');
  163. // Breaking the event chain
  164. return false;
  165. }
  166. }
  167. /**
  168. * This event is triggered when properties are requested for a certain
  169. * node.
  170. *
  171. * This allows us to inject any properties early.
  172. *
  173. * @param PropFind $propFind
  174. * @param INode $node
  175. * @return void
  176. */
  177. public function propFind(PropFind $propFind, INode $node) {
  178. if ($node instanceof CalendarHome && $propFind->getDepth() === 1) {
  179. $backend = $node->getCalDAVBackend();
  180. if ($backend instanceof CalDavBackend) {
  181. $calendars = $node->getChildren();
  182. $calendars = array_filter($calendars, function (INode $node) {
  183. return $node instanceof IShareable;
  184. });
  185. /** @var int[] $resourceIds */
  186. $resourceIds = array_map(function (IShareable $node) {
  187. return $node->getResourceId();
  188. }, $calendars);
  189. $backend->preloadShares($resourceIds);
  190. }
  191. }
  192. if ($node instanceof IShareable) {
  193. $propFind->handle('{' . Plugin::NS_OWNCLOUD . '}invite', function () use ($node) {
  194. return new Invite(
  195. $node->getShares()
  196. );
  197. });
  198. }
  199. }
  200. }