Radicale 3.8.0__tar.gz → 3.8.2__tar.gz

{radicale-3.8.0 → radicale-3.8.2}/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 3.8.2
+* Add: tests: sharing API plus CalDAV/CardDAV workflow and corrupt CSV handling (covers #2259)
+* Add: tests: mocked LDAP, IMAP, OAuth2 and PAM authentication servers (covers #2259)
+* Improve: storage hook: avoid using preexc_fn, use process_group
+* Add: sharing/token: plain GET and HEAD serve free/busy when Actions config `view` is `freebusy`
+* Add: WebUI read-only free/busy calendar URL under each calendar
+* Add: read-only free/busy view via GET ?view=freebusy
+* Fix: free-busy REPORT returns one VFREEBUSY with FREEBUSY periods and no event details (RFC 4791)
+* Add: rights permission `f` to read free-busy time without event details
+* Fix: free-busy REPORT does not expand transparent recurrences
+* Fix: sharing/bday-conversion: add proper RRULE and RECURRENCE-ID in case of "age" support is triggered
+* Fix: sharing/bday-conversion: do not serve item.vcf in parallel of item.ics
+* Fix: sharing/bday-conversion: adjust etag depending on template (item) or content (collection)
+* Fix: sharing/propfind: remove unexpected additional shares listed in case of request on collection with HTTP_DEPTH=1
+* Add: sharing/bday-conversion: X-RADICALE-NAME to generated bday items
+* Fix: sharing/propfind: suppress (resolved) shares having same URI as native ones
+* Fix: sharing/mkcol+mkcalendar: detect conflict with existing resolved shares
+* Fix: WebUI/sharing: display permissions and share-by-group
+* Performance: guard expensive logging with isEnabledFor (where missed)
+* Performance: use lazy formatting for logger calls (where missed)
+* Fix: delete/sharing: neither allow resolved share nor still mapped collections to be deleted
+* Fix: sharing: resolved share resulting in same path as original requested will not have precedence
+
+## 3.8.1
+* Add: tests: optional caldav-server-tester based CalDAV compatibility test suite (caldav_compat_tests)
+* Fix: sharing/bday-conversion: add missing support for comma separated text components in vcard field N (name)
+* Improvement: rights/from_file: extend detection of conflicting/unsupported permissions on startup
+* Fix: sharing: fix logic of permit/deny permissions for map (mM) and token (tT)
+* Add: support for /.mobileconfig for authenticated user
+* Fix: WebUI sharing/propatch issue
+* Fix: storage/sharing close unguarded os.scandir() iterators
+
 ## 3.8.0
 * Fix: storage/multifilesystem: depth:1 PROPFIND no longer re-runs the filesystem collision check (path_to_filesystem) for every item in a collection; this made listing large collections O(n^2) on file systems not detected as collision-free
 * Improve: storage/multifilesystem: avoid redundant stat() calls per item in get/upload when use_mtime_and_size_for_item_cache is enabled

{radicale-3.8.0 → radicale-3.8.2}/DOCUMENTATION.md

@@ -2269,6 +2269,35 @@ is thrown instead of returning the results.
 
 Default: 10000
 
+##### freebusy_view_past_days
+
+_(>= 3.8.2)_
+
+Number of days before today included in the default window of the
+read-only free/busy view (`GET` or `HEAD` with `?view=freebusy`). The
+window starts at midnight UTC. `0` starts the window at midnight UTC
+today. A request that provides both `start` and `end`
+(`YYYYMMDDTHHMMSSZ`) overrides this default and
+`freebusy_view_future_days`.
+
+Default: 365
+
+##### freebusy_view_future_days
+
+_(>= 3.8.2)_
+
+Number of days after today included in the default window of the
+read-only free/busy view. The window ends at midnight UTC that many
+days ahead. `0` ends the window at midnight UTC today.
+
+Default: 365
+
+A share-by-token can omit `?view=freebusy`. Set that token's Actions
+config `view` to `freebusy`. Plain `GET` and `HEAD` of the token then
+use this view, including an optional `start` and `end`. Any other
+`view` value is rejected. Other methods keep the token permissions.
+See [Collection Sharing](https://github.com/Kozea/Radicale/blob/master/SHARING.md).
+
 #### [sharing]
 
 _(>= 3.7.0)_
@@ -2370,7 +2399,7 @@ Default permissions for create token-based sharing
 
 Default: `r`
 
-Supported: `rwEePp`
+Supported: `rfwEePp`
 
 ##### default_permissions_create_map
 
@@ -2380,7 +2409,7 @@ Default permissions for map-based sharing
 
 Default: `r`
 
-Supported: `rwEePp`
+Supported: `rfwEePp`
 
 ##### conversion_bday_summary_template
 
@@ -2388,7 +2417,7 @@ _(>= 3.7.5)_
 
 Global template for summary of conversion "bday"
 
-Default: `{{n:f} {n:g}|{fn}|{nickname}} ({year}) (BDAY)`
+Default: `[{n:f} {n:g}|{fn}|{nickname}] ({year}) (BDAY)`
 
 Supported placeholders (data used from VCARD)
  * `{year}`: year of birthday (RFC6350#6.2.5)
@@ -2450,7 +2479,8 @@ Default: `99`
 Radicale has been tested with:
 
 * [Android](https://android.com/) with
-  [DAVx⁵](https://www.davx5.com/) (formerly DAVdroid),
+  [DAVx⁵](https://www.davx5.com/) (formerly DAVdroid) or
+  [KashCal](https://f-droid.org/packages/org.onekash.kashcal),
 * [OneCalendar](https://www.onecalendar.nl/)
 * [GNOME Calendar](https://wiki.gnome.org/Apps/Calendar),
   [Contacts](https://wiki.gnome.org/Apps/Contacts) and
@@ -2676,6 +2706,8 @@ The following `permissions` are recognized:
 * **r:** read address book and calendar collections
 * **i:** subset of **r** that only allows direct access via HTTP method GET
   (CalDAV/CardDAV is susceptible to expensive search requests)
+* **f:** read the free-busy time of a calendar, without event details
+  (**r** includes this)
 * **W:** write collections (excluding address books and calendars)
 * **w:** write address book and calendar collections
 * **D:** allow deleting a collection in case `permit_delete_collection=False` _(>= 3.3.0)_

{radicale-3.8.0 → radicale-3.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Radicale
-Version: 3.8.0
+Version: 3.8.2
 Summary: CalDAV and CardDAV Server
 Author-email: Guillaume Ayoub <guillaume.ayoub@kozea.fr>, Unrud <unrud@outlook.com>, Peter Bieringer <pb@bieringer.de>
 License: GNU GPL v3
@@ -54,6 +54,10 @@ Requires-Dist: mypy; extra == "dev"
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-playwright; extra == "dev"
 Requires-Dist: html5validator; extra == "dev"
+Provides-Extra: caldav-test
+Requires-Dist: pytest>=7; extra == "caldav-test"
+Requires-Dist: caldav>=3.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: caldav-server-tester<2,>=1.2; python_version >= "3.10" and extra == "caldav-test"
 Dynamic: license-file
 
 # Radicale

{radicale-3.8.0 → radicale-3.8.2}/Radicale.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Radicale
-Version: 3.8.0
+Version: 3.8.2
 Summary: CalDAV and CardDAV Server
 Author-email: Guillaume Ayoub <guillaume.ayoub@kozea.fr>, Unrud <unrud@outlook.com>, Peter Bieringer <pb@bieringer.de>
 License: GNU GPL v3
@@ -54,6 +54,10 @@ Requires-Dist: mypy; extra == "dev"
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-playwright; extra == "dev"
 Requires-Dist: html5validator; extra == "dev"
+Provides-Extra: caldav-test
+Requires-Dist: pytest>=7; extra == "caldav-test"
+Requires-Dist: caldav>=3.0; python_version >= "3.10" and extra == "caldav-test"
+Requires-Dist: caldav-server-tester<2,>=1.2; python_version >= "3.10" and extra == "caldav-test"
 Dynamic: license-file
 
 # Radicale

{radicale-3.8.0 → radicale-3.8.2}/Radicale.egg-info/SOURCES.txt

@@ -7,7 +7,6 @@ config
 pyproject.toml
 radicale.wsgi
 rights
-setup.cfg
 Radicale.egg-info/PKG-INFO
 Radicale.egg-info/SOURCES.txt
 Radicale.egg-info/dependency_links.txt

{radicale-3.8.0 → radicale-3.8.2}/Radicale.egg-info/requires.txt

@@ -10,6 +10,13 @@ argon2-cffi
 [bcrypt]
 bcrypt
 
+[caldav_test]
+pytest>=7
+
+[caldav_test:python_version >= "3.10"]
+caldav>=3.0
+caldav-server-tester<2,>=1.2
+
 [dev]
 flake8
 isort

{radicale-3.8.0 → radicale-3.8.2}/config

@@ -372,11 +372,11 @@ type = none
 #enforce_properties_overlay = true
 
 # Default permissions for token-based sharing
-#   Supported: rwEePp
+#   Supported: rfwEePp
 #default_permissions_create_token = rp
 
 # Default permissions for map-based sharing
-#   Supported: rwEePp
+#   Supported: rfwEePp
 #default_permissions_create_map = r
 
 # Global template for summary of conversion "bday"
@@ -526,3 +526,9 @@ Content-Security-Policy = default-src 'self'; object-src 'none'
 # When returning a free-busy report, limit the number of returned
 # occurences per event to prevent DoS attacks.
 #max_freebusy_occurrence = 10000
+
+# Days before and after today in the default free-busy view
+# (?view=freebusy). The window is aligned to midnight UTC.
+# A request can override both with start and end.
+#freebusy_view_past_days = 365
+#freebusy_view_future_days = 365

{radicale-3.8.0 → radicale-3.8.2}/pyproject.toml

@@ -3,7 +3,7 @@ name = "Radicale"
 # When the version is updated, a new section in the CHANGELOG.md file must be
 # added too.
 readme = "README.md"
-version = "3.8.0"
+version = "3.8.2"
 authors = [{name = "Guillaume Ayoub", email = "guillaume.ayoub@kozea.fr"}, {name = "Unrud", email = "unrud@outlook.com"}, {name = "Peter Bieringer", email = "pb@bieringer.de"}]
 license = {text = "GNU GPL v3"}
 description = "CalDAV and CardDAV Server"
@@ -46,6 +46,7 @@ argon2 = ["argon2-cffi"]
 ldap = ["ldap3"]
 pam = ["pam"]
 dev = ["flake8", "isort", "mypy", "pytest", "pytest-playwright", "html5validator"]
+caldav_test = ["pytest>=7", "caldav>=3.0; python_version >= '3.10'", "caldav-server-tester>=1.2,<2; python_version >= '3.10'"]
 
 [project.scripts]
 radicale = "radicale.__main__:run"
@@ -56,9 +57,10 @@ build-backend = "setuptools.build_meta"
 
 [tool.tox]
 min_version = "4.0"
-envlist = ["flake8", "isort", "mypy", "py_loglevel_info", "py_radicale_loglevel_info", "py_radicale_loglevel_trace", "py", "integ_test", "html5validator"]
+envlist = ["flake8", "isort", "mypy", "py_loglevel_info", "py_radicale_loglevel_info", "py_radicale_loglevel_trace", "py", "integ_test", "caldav_compat_test", "html5validator"]
 
 [tool.tox.env.py]
+description = "Server: run 'pytest' (incl. coverage report)"
 extras = ["test"]
 deps = [
     "pytest",
@@ -67,6 +69,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--cov", "--cov-report=term", "--cov-report=xml", "."]]
 
 [tool.tox.env.py_loglevel_info]
+description = "Server: run 'pytest' with log level 'INFO'"
 extras = ["test"]
 deps = [
     "pytest"
@@ -74,6 +77,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--log-level", "INFO", "."]]
 
 [tool.tox.env.py_radicale_loglevel_info]
+description = "Server: run 'pytest' with radicale  on log level 'INFO'"
 extras = ["test"]
 setenv = { PYTEST_RADICALE_LOGLEVEL = "info" }
 deps = [
@@ -82,6 +86,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--log-level", "INFO", "."]]
 
 [tool.tox.env.py_radicale_loglevel_trace]
+description = "Server: run 'pytest' with radicale  on log level 'TRACE'"
 extras = ["test"]
 setenv = { PYTEST_RADICALE_LOGLEVEL = "trace" }
 deps = [
@@ -90,6 +95,7 @@ deps = [
 commands = [["pytest", "-r", "s", "--log-level", "5", "."]]
 
 [tool.tox.env.py_filesystem_vfat]
+description = "Server: run 'pytest' with collection storage filesystem 'vfat' (on Linux)"
 allowlist_externals = [ "sudo", "dd", "mkfs.vfat", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
 deps = [
@@ -117,6 +123,7 @@ commands_post = [
 ]
 
 [tool.tox.env.py_filesystem_vfat_utf8]
+description = "Server: run 'pytest' with collection storage filesystem 'vfat+utf8' (on Linux)"
 allowlist_externals = [ "sudo", "dd", "mkfs.vfat", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
 deps = [
@@ -144,6 +151,7 @@ commands_post = [
 ]
 
 [tool.tox.env.py_filesystem_hfsplus]
+description = "Server: run 'pytest' with collection storage filesystem 'hfsplus' (on Linux)"
 # Fedora
 allowlist_externals = [ "sudo", "dd", "mkfs.hfsplus", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
@@ -172,6 +180,7 @@ commands_post = [
 ]
 
 [tool.tox.env.py_filesystem_ntfs]
+description = "Server: run 'pytest' with collection storage filesystem 'ntfs' (on Linux)"
 allowlist_externals = [ "sudo", "dd", "mkfs.ntfs", "mkdir", "rm", "rmdir", "chmod" ]
 extras = ["test"]
 deps = [
@@ -199,34 +208,57 @@ commands_post = [
 ]
 
 [tool.tox.env.flake8]
+description = "Server: test code style"
 deps = ["flake8==7.1.0"]
 commands = [["flake8", "."]]
 skip_install = true
 
 [tool.tox.env.isort]
+description = "Server: test import sort order"
 deps = ["isort==5.13.2"]
 commands = [["isort", "--check", "--diff", "."]]
 skip_install = true
 
 [tool.tox.env.mypy]
+description = "Server: test static types"
 deps = ["mypy==1.11.0"]
 commands = [["mypy", "--install-types", "--non-interactive", "."]]
 skip_install = true
 
 [tool.tox.env.integ_test]
+description = "Server+WebUI: run 'playwright' integration tests (with 'chromium')"
 deps = ["pytest", "pytest-playwright"]
 # Store Playwright browsers inside .tox for better caching
 setenv = { PLAYWRIGHT_BROWSERS_PATH = "{toxworkdir}/.playwright" }
 commands_pre = [["playwright", "install", "chromium"]]
 commands = [["pytest", "integ_tests"]]
 
+[tool.tox.env.caldav_compat_test]
+description = "Server: run caldav compatibility tests"
+extras = ["caldav_test"]
+deps = [
+    "caldav",
+    "caldav_server_tester==1.2.0",  # synchronize version with .github/workflows/test.yml#caldav-compat-test
+    "pytest"
+]
+commands = [["pytest", "caldav_compat_tests"]]
+
+[tool.tox.env.js]
+# for optional local test as of now, copied from .github/workflows/test.yml
+# Fedora (will install nodejs): yum install npx
+description = "WebUI: validate JavaScript"
+allowlist_externals = [ "npx" ]
+commands = [["npx", "-y", "-p", "typescript@7.0.2", "tsc", "-p", "radicale/web/jsconfig.json"]]
+skip_install = true
+
 [tool.tox.env.html5validator]
+description = "WebUI: validate HTML"
 deps = ["html5validator-2"]
 commands = [["html5validator", "--root", "radicale/web/internal_data/", "--also-check-css"]]
 
 
 [tool.pytest.ini_options]
-norecursedirs = ["integ_tests"]
+norecursedirs = ["integ_tests", "caldav_compat_tests"]
 
 
 [tool.setuptools]
@@ -234,7 +266,7 @@ platforms = ["Any"]
 include-package-data = false
 
 [tool.setuptools.packages.find]
-exclude = ["*.tests", "integ_tests"] # *.tests.*; tests.*; tests
+exclude = ["*.tests", "integ_tests", "caldav_compat_tests"] # *.tests.*; tests.*; tests
 namespaces = false
 
 [tool.setuptools.package-data]
@@ -266,7 +298,7 @@ exclude = "(^|/)build($|/)"
 [tool.coverage.run]
 branch = true
 source = ["radicale"]
-omit = ["tests/*", "*/tests/*", "integ_tests/*", "*/integ_tests/*"]
+omit = ["tests/*", "*/tests/*", "integ_tests/*", "*/integ_tests/*", "caldav_compat_tests/*", "*/caldav_compat_tests/*"]
 
 [tool.coverage.report]
 # Regexes for lines to exclude from consideration

{radicale-3.8.0 → radicale-3.8.2}/radicale/app/__init__.py

@@ -45,7 +45,7 @@ from radicale import config, httputils, log, pathutils, types, utils
 from radicale.app import base as app_base
 from radicale.app.base import ApplicationBase
 from radicale.app.delete import ApplicationPartDelete
-from radicale.app.get import ApplicationPartGet
+from radicale.app.get import ApplicationPartGet, requests_freebusy_view
 from radicale.app.head import ApplicationPartHead
 from radicale.app.mkcalendar import ApplicationPartMkcalendar
 from radicale.app.mkcol import ApplicationPartMkcol
@@ -305,7 +305,8 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                                     condition=self._response_content_on_notice_condition,
                                     value=request_info,
                                     ):
-                                logger.notice("Response content (nonXML, log condition passed):\n%s", utils.textwrap_str(answer, self._limit_content))
+                                if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                                    logger.notice("Response content (nonXML, log condition passed):\n%s", utils.textwrap_str(answer, self._limit_content))
                         else:
                             if logger.isEnabledFor(logging.DEBUG):
                                 logger.debug("Response content: suppressed by config/option [logging] response_content_on_debug")
@@ -340,7 +341,8 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                             condition=self._response_header_on_notice_condition,
                             value=request_info,
                             ):
-                        logger.notice("Response header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(headers), self._limit_content))
+                        if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                            logger.notice("Response header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(headers), self._limit_content))
                 else:
                     if logger.isEnabledFor(logging.DEBUG):
                         logger.debug("Response header: suppressed by config/option [logging] response_header_on_debug")
@@ -474,8 +476,9 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                     request_method, unsafe_path, depthinfo,
                     remote_host, remote_useragent_txt, https_info)
         if self._request_header_on_debug:
-            logger.debug("Request header:\n%s",
-                         utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
+            if logger.isEnabledFor(logging.DEBUG):
+                logger.debug("Request header:\n%s",
+                             utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
         else:
             if not self._request_header_on_notice_condition != {}:
                 # conditional request header logging is later
@@ -570,7 +573,8 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                     condition=self._request_header_on_notice_condition,
                     value=request_info,
                     ):
-                logger.notice("Request header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
+                if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                    logger.notice("Request header (log condition passed):\n%s", utils.textwrap_str(pprint.pformat(self._scrub_headers(environ)), self._limit_content))
 
         if user and login == user:
             logger.info("Successful login: %r (%s)", user, info)
@@ -668,8 +672,12 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
                     profiler_active = True
 
             try:
-                status, headers, answer, xml_request = function(
-                    environ, base_prefix, path, user, request_info)
+                if (requests_freebusy_view(environ) and
+                        request_method not in ("GET", "HEAD")):
+                    status, headers, answer, xml_request = httputils.METHOD_NOT_ALLOWED
+                else:
+                    status, headers, answer, xml_request = function(
+                        environ, base_prefix, path, user, request_info)
             except PermissionError as e:
                 logger.error("PermissionError: %s", e)
                 status, headers, answer, xml_request = httputils.INTERNAL_SERVER_ERROR

{radicale-3.8.0 → radicale-3.8.2}/radicale/app/base.py

@@ -215,7 +215,8 @@ class ApplicationBase:
                         condition=self._request_content_on_notice_condition,
                         value=request_info,
                         ):
-                    logger.notice("Request content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
+                    if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                        logger.notice("Request content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
                 else:
                     if logger.isEnabledFor(logging.DEBUG):
                         logger.debug("Request content (XML, log condition skipped): suppressed")
@@ -236,7 +237,8 @@ class ApplicationBase:
                         condition=self._response_content_on_notice_condition,
                         value=request_info,
                         ):
-                    logger.notice("Response content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
+                    if logger.isEnabledFor(log.LOG_LEVEL_NOTICE):
+                        logger.notice("Response content (XML, log condition passed):\n%s", utils.textwrap_str(xmlutils.pretty_xml(xml_content)))
                 else:
                     if logger.isEnabledFor(logging.DEBUG):
                         logger.debug("Response content (XML, log condition skipped): suppressed")
@@ -255,6 +257,12 @@ class ApplicationBase:
         return status, headers, content, None
 
 
+def _with_implied_freebusy(permissions: str) -> str:
+    if "r" in permissions and "f" not in permissions:
+        return permissions + "f"
+    return permissions
+
+
 class Access:
     """Helper class to check access rights of an item"""
 
@@ -275,8 +283,8 @@ class Access:
         self.permissions = self._rights.authorization(self.user, self.path)
         if permissions_filter is not None:
             self._permissions_filter = permissions_filter
-            permissions_filtered = intersect(self.permissions, permissions_filter)
-            self.permissions = permissions_filtered
+            self.permissions = intersect(
+                _with_implied_freebusy(self.permissions), permissions_filter)
         self._parent_permissions = None
 
     @property
@@ -287,8 +295,9 @@ class Access:
             self._parent_permissions = self._rights.authorization(
                 self.user, self.parent_path)
         if self._permissions_filter is not None:
-            parent_permissions_filtered = intersect(self._parent_permissions, self._permissions_filter)
-            self._parent_permissions = parent_permissions_filtered
+            self._parent_permissions = intersect(
+                _with_implied_freebusy(self._parent_permissions),
+                self._permissions_filter)
         return self._parent_permissions
 
     def check(self, permission: str,
@@ -310,3 +319,11 @@ class Access:
         return bool(rights.intersect(self.permissions, permissions) or (
             self.path != self.parent_path and
             rights.intersect(self.parent_permissions, parent_permissions)))
+
+    def allows_freebusy(self, item: Optional[types.CollectionOrItem] = None
+                        ) -> bool:
+        if item is not None and (
+                not isinstance(item, storage.BaseCollection) or
+                item.tag != "VCALENDAR"):
+            return False
+        return "r" in self.permissions or "f" in self.permissions

{radicale-3.8.0 → radicale-3.8.2}/radicale/app/delete.py

@@ -79,6 +79,9 @@ class ApplicationPartDelete(ApplicationBase):
                 user_lookup += sharing.SHARING_SEPARATOR_GROUP + ','.join(self._rights._user_groups)
             share = self._sharing.sharing_collection_resolver(path, user_lookup)
             if share:
+                if path.endswith('/'):
+                    logger.notice("delete of a mapped collection is never permitted: %r -> %r", share['PathOrToken'], path)
+                    return httputils.NOT_ALLOWED
                 # overwrite and run through extended permission check
                 path = share['PathMapped']
                 user = share['Owner']
@@ -86,6 +89,12 @@ class ApplicationPartDelete(ApplicationBase):
         access = Access(self._rights, user, path, permissions_filter)
         if not access.check("w"):
             return httputils.NOT_ALLOWED
+        if self._sharing._enabled:
+            if not share:
+                collections_share_list = self._sharing.database_list_sharing(PathMapped=path)
+                if collections_share_list is not None and len(collections_share_list) > 0:
+                    logger.notice("delete of a mapped collection in use (%d) is not permitted: %r", len(collections_share_list), path)
+                    return httputils.CONFLICT
         with self._storage.acquire_lock("w", user, path=path, request="DELETE"):
             item = next(iter(self._storage.discover(path)), None)
             if not item:
@@ -100,11 +109,11 @@ class ApplicationPartDelete(ApplicationBase):
             if isinstance(item, storage.BaseCollection):
                 if self._permit_delete_collection:
                     if access.check("d", item):
-                        logger.info("delete of collection is permitted by config/option [rights] permit_delete_collection but explicit forbidden by permission 'd': %s", path)
+                        logger.info("delete of collection is permitted by config/option [rights] permit_delete_collection but explicit forbidden by permission 'd': %r", path)
                         return httputils.NOT_ALLOWED
                 else:
                     if not access.check("D", item):
-                        logger.info("delete of collection is prevented by config/option [rights] permit_delete_collection and not explicit allowed by permission 'D': %s", path)
+                        logger.info("delete of collection is prevented by config/option [rights] permit_delete_collection and not explicit allowed by permission 'D': %r", path)
                         return httputils.NOT_ALLOWED
                 if self._hook.enabled:
                     for i in item.get_all():