From 7c1b9a875484145cb07a483c46253f0b0d81c32e Mon Sep 17 00:00:00 2001 From: hamza Date: Thu, 29 Oct 2026 16:05:44 +0100 Subject: [PATCH] fix(dav): do not grant write-properties to read-only calendar delegates Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-X8QPVS7S. Assisted-by: omp:claude-opus-5-5 Signed-off-by: hamza --- apps/dav/lib/CalDAV/Calendar.php | 6 ------ apps/dav/tests/unit/CalDAV/CalendarTest.php | 6 ------ 2 files changed, 12 deletions(-) diff --git a/apps/dav/lib/CalDAV/Calendar.php b/apps/dav/lib/CalDAV/Calendar.php index 75c815c3b0adb..9b69c292598e3 100644 --- a/apps/dav/lib/CalDAV/Calendar.php +++ b/apps/dav/lib/CalDAV/Calendar.php @@ -200,12 +200,6 @@ public function getACL() { ]; } - $acl[] = [ - 'privilege' => '{DAV:}write-properties', - 'principal' => $this->getOwner() . '/calendar-proxy-read', - 'protected' => true, - ]; - if (!$this->isShared()) { return $acl; } diff --git a/apps/dav/tests/unit/CalDAV/CalendarTest.php b/apps/dav/tests/unit/CalDAV/CalendarTest.php index 95cedb6da6aa6..117d1117c9f07 100644 --- a/apps/dav/tests/unit/CalDAV/CalendarTest.php +++ b/apps/dav/tests/unit/CalDAV/CalendarTest.php @@ -253,12 +253,6 @@ public function testAcl($expectsWrite, $readOnlyValue, $hasOwnerSet, $uri = 'def ]; } - $expectedAcl[] = [ - 'privilege' => '{DAV:}write-properties', - 'principal' => ($hasOwnerSet ? 'user1' : 'user2') . '/calendar-proxy-read', - 'protected' => true - ]; - if ($hasOwnerSet) { $expectedAcl[] = [ 'privilege' => '{DAV:}read',