This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * @author Bart Visscher <[email protected]> |
||
4 | * @author Felix Moeller <[email protected]> |
||
5 | * @author Jakob Sack <[email protected]> |
||
6 | * @author Jörn Friedrich Dreyer <[email protected]> |
||
7 | * @author Lukas Reschke <[email protected]> |
||
8 | * @author Morris Jobke <[email protected]> |
||
9 | * @author Sebastian Döll <[email protected]> |
||
10 | * @author Thomas Müller <[email protected]> |
||
11 | * @author Thomas Tanghus <[email protected]> |
||
12 | * @author Vincent Petry <[email protected]> |
||
13 | * |
||
14 | * @copyright Copyright (c) 2015, ownCloud, Inc. |
||
15 | * @license AGPL-3.0 |
||
16 | * |
||
17 | * This code is free software: you can redistribute it and/or modify |
||
18 | * it under the terms of the GNU Affero General Public License, version 3, |
||
19 | * as published by the Free Software Foundation. |
||
20 | * |
||
21 | * This program is distributed in the hope that it will be useful, |
||
22 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
23 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
24 | * GNU Affero General Public License for more details. |
||
25 | * |
||
26 | * You should have received a copy of the GNU Affero General Public License, version 3, |
||
27 | * along with this program. If not, see <http://www.gnu.org/licenses/> |
||
28 | * |
||
29 | */ |
||
30 | |||
31 | namespace OCA\Contacts\Sabre; |
||
32 | |||
33 | use OCP\IUserManager; |
||
34 | use OCP\IConfig; |
||
35 | use \Sabre\DAV\PropPatch; |
||
36 | |||
37 | class Principal implements \Sabre\DAVACL\PrincipalBackend\BackendInterface { |
||
38 | /** @var IConfig */ |
||
39 | private $config; |
||
40 | /** @var IUserManager */ |
||
41 | private $userManager; |
||
42 | |||
43 | /** |
||
44 | * @param IConfig $config |
||
45 | * @param IUserManager $userManager |
||
46 | */ |
||
47 | public function __construct(IConfig $config, |
||
48 | IUserManager $userManager) { |
||
49 | $this->config = $config; |
||
50 | $this->userManager = $userManager; |
||
51 | } |
||
52 | |||
53 | /** |
||
54 | * Returns a list of principals based on a prefix. |
||
55 | * |
||
56 | * This prefix will often contain something like 'principals'. You are only |
||
57 | * expected to return principals that are in this base path. |
||
58 | * |
||
59 | * You are expected to return at least a 'uri' for every user, you can |
||
60 | * return any additional properties if you wish so. Common properties are: |
||
61 | * {DAV:}displayname |
||
62 | * |
||
63 | * @param string $prefixPath |
||
64 | * @return string[] |
||
65 | */ |
||
66 | public function getPrincipalsByPrefix($prefixPath) { |
||
67 | $principals = []; |
||
68 | |||
69 | if ($prefixPath === 'principals') { |
||
70 | foreach($this->userManager->search('') as $user) { |
||
71 | |||
72 | $principal = [ |
||
73 | 'uri' => 'principals/' . $user->getUID(), |
||
74 | '{DAV:}displayname' => $user->getUID(), |
||
75 | ]; |
||
76 | |||
77 | $email = $this->config->getUserValue($user->getUID(), 'settings', 'email'); |
||
78 | if(!empty($email)) { |
||
79 | $principal['{http://sabredav.org/ns}email-address'] = $email; |
||
80 | } |
||
81 | |||
82 | $principals[] = $principal; |
||
83 | } |
||
84 | } |
||
85 | |||
86 | return $principals; |
||
87 | } |
||
88 | |||
89 | /** |
||
90 | * Returns a specific principal, specified by it's path. |
||
91 | * The returned structure should be the exact same as from |
||
92 | * getPrincipalsByPrefix. |
||
93 | * |
||
94 | * @param string $path |
||
95 | * @return array |
||
96 | */ |
||
97 | public function getPrincipalByPath($path) { |
||
98 | list($prefix, $name) = explode('/', $path); |
||
99 | $user = $this->userManager->get($name); |
||
100 | |||
101 | if ($prefix === 'principals' && !is_null($user)) { |
||
102 | $principal = [ |
||
103 | 'uri' => 'principals/' . $user->getUID(), |
||
104 | '{DAV:}displayname' => $user->getUID(), |
||
105 | ]; |
||
106 | |||
107 | $email = $this->config->getUserValue($user->getUID(), 'settings', 'email'); |
||
108 | if($email) { |
||
109 | $principal['{http://sabredav.org/ns}email-address'] = $email; |
||
110 | } |
||
111 | |||
112 | return $principal; |
||
113 | } |
||
114 | |||
115 | return null; |
||
116 | } |
||
117 | |||
118 | /** |
||
119 | * Returns the list of members for a group-principal |
||
120 | * |
||
121 | * @param string $principal |
||
122 | * @return string[] |
||
123 | * @throws \Sabre\DAV\Exception |
||
124 | */ |
||
125 | public function getGroupMemberSet($principal) { |
||
126 | // TODO: for now the group principal has only one member, the user itself |
||
127 | $principal = $this->getPrincipalByPath($principal); |
||
128 | if (!$principal) { |
||
129 | throw new \Sabre\DAV\Exception('Principal not found'); |
||
130 | } |
||
131 | |||
132 | return [$principal['uri']]; |
||
133 | } |
||
134 | |||
135 | /** |
||
136 | * Returns the list of groups a principal is a member of |
||
137 | * |
||
138 | * @param string $principal |
||
139 | * @return array |
||
140 | * @throws \Sabre\DAV\Exception |
||
141 | */ |
||
142 | public function getGroupMembership($principal) { |
||
0 ignored issues
–
show
|
|||
143 | list($prefix, $name) = \Sabre\HTTP\URLUtil::splitPath($principal); |
||
144 | |||
145 | $group_membership = array(); |
||
146 | if ($prefix === 'principals') { |
||
147 | $principal = $this->getPrincipalByPath($principal); |
||
148 | if (!$principal) { |
||
149 | throw new \Sabre\DAV\Exception('Principal not found'); |
||
150 | } |
||
151 | |||
152 | // TODO: for now the user principal has only its own groups |
||
153 | return array( |
||
154 | 'principals/'.$name.'/calendar-proxy-read', |
||
155 | 'principals/'.$name.'/calendar-proxy-write', |
||
156 | // The addressbook groups are not supported in Sabre, |
||
157 | // see http://groups.google.com/group/sabredav-discuss/browse_thread/thread/ef2fa9759d55f8c#msg_5720afc11602e753 |
||
158 | //'principals/'.$name.'/addressbook-proxy-read', |
||
159 | //'principals/'.$name.'/addressbook-proxy-write', |
||
160 | ); |
||
161 | } |
||
162 | return $group_membership; |
||
163 | } |
||
164 | |||
165 | /** |
||
166 | * Updates the list of group members for a group principal. |
||
167 | * |
||
168 | * The principals should be passed as a list of uri's. |
||
169 | * |
||
170 | * @param string $principal |
||
171 | * @param array $members |
||
172 | * @throws \Sabre\DAV\Exception |
||
173 | */ |
||
174 | public function setGroupMemberSet($principal, array $members) { |
||
175 | throw new \Sabre\DAV\Exception('Setting members of the group is not supported yet'); |
||
176 | } |
||
177 | |||
178 | /** |
||
179 | * @param string $path |
||
180 | * @param PropPatch $propPatch |
||
181 | * @return int |
||
182 | */ |
||
183 | function updatePrincipal($path, PropPatch $propPatch) { |
||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
It is recommend to declare an explicit visibility for
updatePrincipal .
Generally, we recommend to declare visibility for all methods in your source code. This has the advantage of clearly communication to other developers, and also yourself, how this method should be consumed. If you are not sure which visibility to choose, it is a good idea to start with
the most restrictive visibility, and then raise visibility as needed, i.e.
start with ![]() |
|||
184 | return 0; |
||
185 | } |
||
186 | |||
187 | /** |
||
188 | * @param string $prefixPath |
||
189 | * @param array $searchProperties |
||
190 | * @param string $test |
||
191 | * @return array |
||
192 | */ |
||
193 | function searchPrincipals($prefixPath, array $searchProperties, $test = 'allof') { |
||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
It is recommend to declare an explicit visibility for
searchPrincipals .
Generally, we recommend to declare visibility for all methods in your source code. This has the advantage of clearly communication to other developers, and also yourself, how this method should be consumed. If you are not sure which visibility to choose, it is a good idea to start with
the most restrictive visibility, and then raise visibility as needed, i.e.
start with ![]() |
|||
194 | return []; |
||
195 | } |
||
196 | |||
197 | /** |
||
198 | * @param string $uri |
||
199 | * @param string $principalPrefix |
||
200 | * @return string |
||
201 | */ |
||
202 | function findByUri($uri, $principalPrefix) { |
||
0 ignored issues
–
show
Comprehensibility
Best Practice
introduced
by
It is recommend to declare an explicit visibility for
findByUri .
Generally, we recommend to declare visibility for all methods in your source code. This has the advantage of clearly communication to other developers, and also yourself, how this method should be consumed. If you are not sure which visibility to choose, it is a good idea to start with
the most restrictive visibility, and then raise visibility as needed, i.e.
start with ![]() |
|||
203 | return ''; |
||
204 | } |
||
205 | } |
||
206 |
This check marks variable names that have not been written in camelCase.
In camelCase names are written without any punctuation, the start of each new word being marked by a capital letter. Thus the name database connection string becomes
databaseConnectionString
.